CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google cloud bigquery, colab enterprise, dataform +2 moreCross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise9.4 Critical
- magepeopleteam car rental managerWordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability5.3 Medium
- andy moyle church adminWordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability5.3 Medium
- saad iqbal mycredWordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability5.4 Medium
- saad iqbal license manager for woocommerceWordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability5.4 Medium
- jose vega woocommerce bulk edit products – wp sheet editorWordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability4.9 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability6.5 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability6.5 Medium
- thememove edumallWordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability4.3 Medium
- presstigers universal clocksWordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability5.3 Medium
- hamastar technology meetinghubWordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability5.3 Medium
- themebeez fascinateWordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability5.3 Medium
- wpdevart booking calendar, appointment booking systemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw weddingWordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw food cornerWordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability5.3 Medium
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability7.1 High
- ux-themes flatsomeWordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability7.5 High
- themeum kirkiWordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability7.5 High
- nexcess event ticketsWordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability7.5 High
- knitpay razorpay payment links for woocommerceWordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability6.5 Medium
- fahad mahmood stock locations for woocommerceWordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability6.5 Medium
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability6.5 Medium
- codemenschen gift vouchersWordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability6.5 Medium
- peachpayments peach payments gatewayWordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability6.5 Medium
- roxnor fundengineWordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability6.5 Medium
- themehunk open shopWordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability7.1 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability6.5 Medium
- wp swings event tickets manager for woocommerceWordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability6.5 Medium
- themefic tourficWordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability6.5 Medium
- themefic tourficWordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability6.5 Medium
- edgarrojas extra product options builder for woocommerceWordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability6.5 Medium
- phil kurth advanced formsWordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability7.5 High
- wpxpo wowaddonsWordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability6.5 Medium
- fluxbuilder mstore api, mstore api +1 moreWordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability6.5 Medium
- mattermost, mattermost server +1 moreOrdinary group/direct message member can enable group_constrained and remove all channel participants5.4 Medium
- ollyo helix ultimate, joomshaper.com helix ultimate extension for joomla +1 moreJoomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.78.8 High
- will-moss isaiahwill-moss Isaiah Master Websocket server.go Server.Handle authorization6.9 Medium
- coollabsio coolifycoollabsio Coolify Policy Policies authorization5.3 Medium
- imagemagickImageMagick before 7.1.2-26 Policy Bypass via APNG encoder4.8 Medium
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via PATCH7.1 High
- mervinpraison praisonaiPraisonAI AgentMail before 4.6.78 Message Injection via Webhook6.9 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action5.3 Medium
- subratamal wallet for woocommerceWallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action4.3 Medium
- wclovers wcfm – frontend manager for woocommerceWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller5.3 Medium
- saadiqbal wp easy pay – payment and donation form builder for squareWP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action4.3 Medium
- wupsales ai copilot – content generatorAI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions5.3 Medium
- thrivedesk agentic help desk plugin for wordpress – live chat, ai chatbot & ticketing – thrivedeskThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion4.3 Medium
- solacewp solace extraSolace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action5.3 Medium
- redefiningtheweb affiliate program & referral tracking for woocommerce & wordpress – affiliaAffilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification4.3 Medium
- wupsales ai copilot – content generatorAI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'5.3 Medium
- Show moreLoading…