rootpwn

low · CVSS v3 3.7 · EPSS 0.0018

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions…

Description

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

Scores

Severity
low
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
—
EPSS
0.0018

← All CVEs

Related CVEs

low

CVE-2026-71178

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

View analysis

low

CVE-2026-4921

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

View analysis

low

CVE-2026-91077

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.

View analysis

low

CVE-2026-85220

Thinkst Canary honeypots with the Redis service enabled are vulnerable to an unauthenticated remote denial‑of‑service attack. The flaw allows attackers to crash the Redis process, disrupting the honeypot’s availability. Thinkst has released patches for all supported platforms, including a new Docker image.

View analysis