Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVEs (9,997)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-10673 - - Jun 17, 2026 Nov 9, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and includi...Show more The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.Show less
CVE-2024-10588 - - Jun 17, 2026 Nov 9, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to, and including, 2.2. This makes it possible for authenticate...Show more The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to obtain information from phpinfo(). When WP_DEBUG is enabled, this can be exploited by unauthenticated users as well.Show less
CVE-2024-10586 - - Jun 17, 2026 Nov 9, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2....Show more The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution. CVE-2024-52416 may be a duplicate of this issue.Show less
CVE-2024-10294 1Ce21 1Ce21 Suite Jun 17, 2026 Nov 9, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. Th...Show more The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings.Show less
CVE-2024-48073 - - Jun 17, 2026 Nov 8, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPA...Show more sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges.Show less
CVE-2024-10824 1Github 1Enterprise Server Jun 17, 2026 Nov 7, 2024 6.0 MEDIUM· v4 6.5 MEDIUM· v3 N/A· v2 An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could...Show more An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2.Show less
CVE-2024-43431 1Moodle 1Moodle Jun 17, 2026 Nov 7, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.
CVE-2024-6626 1Theinnovs 1Eleforms Jun 17, 2026 Nov 6, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and in...Show more The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions.Show less
CVE-2024-10543 1Tumult 1Tumult Hype Animations Jun 17, 2026 Nov 6, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This...Show more The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve animation information.Show less
CVE-2024-10535 1Martinvalchev 1Video Gallery For Woocommerce Jun 17, 2026 Nov 6, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including,...Show more The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory.Show less
CVE-2024-7429 1Katieseaborn 1Zotpress Jun 17, 2026 Nov 5, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This mak...Show more The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.Show less
CVE-2024-51516 1Huawei 1Harmonyos Jun 17, 2026 Nov 5, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally.
CVE-2024-48045 1Leevio 1Happy Addons For Elementor Jun 17, 2026 Nov 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor:...Show more Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.Show less
CVE-2024-48044 1Shortpixel 1Image Optimizer Jun 17, 2026 Nov 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimize...Show more Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.Show less
CVE-2024-48039 1Cubewp 1Cubewp Jun 17, 2026 Nov 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP: from n/a through <= 1.1.15.
CVE-2024-47362 1Wpchill 1Strong Testimonials Jun 17, 2026 Nov 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
CVE-2024-47361 1Webtechstreet 1Elementor Addon Elements Jun 17, 2026 Nov 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
CVE-2024-47359 1Depicter 1Depicter Jun 17, 2026 Nov 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2.
CVE-2024-47358 1Code Atlantic 1Popup Maker Jun 17, 2026 Nov 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.
CVE-2024-47321 1Androidbubbles 1Wp Datepicker Jun 17, 2026 Nov 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.

Previous 1...319320321...500 Next