medium · CVSS v3 4.3

CVE-2026-96963

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, a…

Description

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-97194

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis

medium

CVE-2026-124326

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis

medium

CVE-2026-123561

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.

View analysis

medium

CVE-2026-123567

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ properties via devalue.parse and devalue.unflatten. This can alter object prototypes when merged with Object.assign, potentially changing application behavior. The flaw is exploitable in any code that uses devalue to deserialize data.

View analysis