Veille CVE

Semaine du 28 septembre au 4 octobre 2026

6 CVE

Critique 1 Élevée 2 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Create » ✕
  1. CVE-2026-93549 8.8 Élevée

    Unknown CoCart

    The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.

  2. CVE-2026-91078 8.2 Élevée

    Unknown TillKit

    The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.

  3. CVE-2026-79618 4.3 Moyenne

    Unknown WP User Frontend

    The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.

  4. CVE-2026-101148 10.0 Critique

    Unknown BackupSheep WordPress Backup Plugin

    The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

  5. CVE-2026-94297 2.7 Faible

    Unknown Media Library Organizer

    The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.

  6. CVE-2026-75824 5.3 Moyenne

    Unknown User Frontend

    The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role.