rootpwn

high · CVSS v3 7.5 · EPSS 0.0015

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio…

Description

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.

Scores

Severity
high
CVSS v2
5.5
CVSS v3
7.5
CVSS v4
—
EPSS
0.0015

← All CVEs

Related CVEs

high

CVE-2026-93974

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-87839

The Tripzzy WordPress plugin (v<1.5.1) lacks authorization checks on an AJAX endpoint, letting unauthenticated users delete any comment. This flaw can erase user-generated content and disrupt site integrity. It is a high‑severity vulnerability that can be exploited without credentials.

View analysis

high

CVE-2026-92252

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This may disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated WatchDog process.

View analysis

high

CVE-2026-92253

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file path and persuading an administrator to restore the file. This may enable modification of protected files or SYSTEM-level code execution through DLL hijacking.

View analysis