Veille CVE

Jeudi 15 octobre 2026

3 CVE

Critique 1 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Create » ✕
  1. CVE-2026-96537 7.5 Élevée

    Unknown Tutor LMS

    The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

  2. CVE-2026-109145 9.8 Critique

    Unknown User Rights Access Manager

    The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

  3. CVE-2026-103304 5.3 Moyenne

    Unknown eaSYNC Booking

    The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.