Broken Access Control vulnerabilities in WordPress plugins and themes
Broken access control means a feature checks that you are logged in but never checks whether you are allowed. In WordPress it usually appears as an AJAX or REST endpoint registered without a capability check, so any authenticated user — including a subscriber who signed up seconds ago — can call it.
What an attacker can do: reach actions or data that should have been restricted to someone else CWE-862
- YITH WooCommerce Wishlist - Broken Access Control (CVE-2026-82305) MEDIUM
- teddy-bear-customize-addon - Broken Access Control (CVE-2026-14559) CRITICAL
- WP Fast Total Search - Broken Access Control (CVE-2026-84821) HIGH
- Return Refund and Exchange For WooCommerce - Broken Access Control (CVE-2026-81799) HIGH
- Woo Shirt Product Designer - Broken Access Control (CVE-2026-81794) HIGH
- Salon booking system - Broken Access Control (CVE-2026-81793) MEDIUM
- IMPress for IDX Broker - Broken Access Control (CVE-2026-81788) MEDIUM
- Thank You Page Customizer for WooCommerce - Broken Access Control (CVE-2026-81786) HIGH
- BuddyForms - Broken Access Control (CVE-2026-81785) MEDIUM
- Robokassa payment gateway for Woocommerce - Broken Access Control (CVE-2026-78536) MEDIUM
- zipMoney(Zip Co) Payments Plugin for WooCommerce - Broken Access Control (CVE-2026-78361) CRITICAL
- Notiqoo - Broken Access Control (CVE-2026-19840) MEDIUM
- Advanced Cf7 Db - Broken Access Control (CVE-2026-18594) MEDIUM
- Builderall Cheetah For Wp - Broken Access Control (CVE-2026-15823) MEDIUM
- Ip2location Country Blocker - Broken Access Control (CVE-2026-82530) MEDIUM
- Eventin - Broken Access Control (CVE-2026-15398) MEDIUM
- Wc Exporter For Reviso - Broken Access Control (CVE-2026-8615) MEDIUM
- Wpfunnels - Broken Access Control (CVE-2026-84908) MEDIUM
- Chatbot - Broken Access Control (CVE-2026-83593) HIGH
- Wp Recipe Maker - Broken Access Control (CVE-2026-75905) MEDIUM
- Ultimate Gift Cards for WooCommerce - Broken Access Control (CVE-2026-75861) MEDIUM
- Awesome Support - Broken Access Control (CVE-2026-19946) MEDIUM
- Eventin - Broken Access Control (CVE-2026-11821) MEDIUM
- Wp Event Solution - Broken Access Control (CVE-2026-12956) MEDIUM
- Event Tickets - Broken Access Control (CVE-2026-3174) HIGH
- Bookly Responsive Appointment Booking Tool - Broken Access Control (CVE-2026-2520) MEDIUM
- Hungarian Pickup Points For Woocommerce - Broken Access Control (CVE-2026-81790) HIGH
- Unbounce - Broken Access Control (CVE-2026-81781) HIGH
- Learning Management System - Broken Access Control (CVE-2026-8279) MEDIUM
- Flamingo - Broken Access Control (CVE-2026-12853) MEDIUM