← Back
CWE-862

8,736 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (8,736)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-36695
1Maximeschoeni
1Sublanguage
Jun 17, 2026
Jun 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
CVE-2023-36694
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
6.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
CVE-2023-36504
1Bbsetheme
1Bbs E Popup
Jun 17, 2026
Jun 14, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
CVE-2023-35045
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7.
CVE-2023-35040
1Pressified
1Sendpress
Jun 17, 2026
Jun 14, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6.
CVE-2023-29174
-
-
Jun 17, 2026
Jun 14, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.
CVE-2024-5674
1Newsletter
1Newsletter
Jun 17, 2026
Jun 12, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. Thi...Show more
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0Show less
CVE-2024-4898
1Instawp
1Instawp Connect
Jun 17, 2026
Jun 12, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0....Show more
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.Show less
CVE-2023-51524
1Weformspro
1Weforms
Jun 17, 2026
Jun 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
CVE-2023-51413
-
-
Jun 17, 2026
Jun 12, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29.
CVE-2023-48280
-
-
Jun 17, 2026
Jun 12, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1.
CVE-2023-47828
1Millermedia
1Mandrill
Jun 17, 2026
Jun 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
CVE-2023-44234
1Devfarm
1Wp Gpx Maps
Jun 17, 2026
Jun 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08.
CVE-2023-41240
1Varktech
1Pricing Deals For Woocommerce
Jun 17, 2026
Jun 12, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Vark Pricing Deals for WooCommerce.This issue affects Pricing Deals for WooCommerce: from n/a through 2.0.3.2.
CVE-2023-40672
-
-
Jun 17, 2026
Jun 12, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
CVE-2023-40603
1Webtechforce
1Simple Org Chart
Jun 17, 2026
Jun 12, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.
CVE-2023-40209
1Himalayasaxena
1Highcompress Image Compressor
Jun 17, 2026
Jun 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
CVE-2023-38395
1Afzalmultani
1Wp Clone Menu
Jun 17, 2026
Jun 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1.
CVE-2023-25030
1Buymeacoffee
1Buy Me A Coffee
Jun 17, 2026
Jun 12, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7.
CVE-2024-5468
-
-
Jun 17, 2026
Jun 12, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to,...Show more
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a site.Show less