critical · CVSS v3 9.8

CVE-2026-115213

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrat…

Description

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

Scores

Severity
critical
CVSS v2
5
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

View analysis

critical

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

View analysis