Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

223 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-53591 Public exploit

    An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.

  • Medium 5.3
    CVE-2025-32259 Public exploit

    WordPress WP ULike plugin <= 4.7.9.1 - Content Spoofing Vulnerability

    Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1.

    alimir WP ULike
  • Medium 5.3
    CVE-2025-2568 Public exploit

    Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update

    The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_tog…

    ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce Web / CMS
  • High 8.8
    CVE-2025-2807 Public exploit

    Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

    The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. Thi…

    stylemix Motors – Car Dealership & Classified Listings Plugin Web / CMS
  • Critical 9.8
    CVE-2025-2266 Public exploit

    Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update

    The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This mak…

    mestresdowp Checkout Mestres do WP for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-30772 Public exploit

    WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.

    wpclever WPC Smart Upsell Funnel for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-8682 Public exploit

    JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration

    The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enable…

    https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 JNews - WordPress Newspaper Magazine Blog AMP Theme Web / CMS
  • Critical 9.8
    CVE-2025-1307 Public exploit

    Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

    The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attac…

    spicethemes Newscrunch Web / CMS
  • High 8.8
    CVE-2025-1639 Public exploit

    Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes …

    crowdyTheme Animation Addons for Elementor Pro Web / CMS
  • Critical 9.8
    CVE-2024-13513 Public exploit

    Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation

    The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extrac…

    oliverpos Oliver POS – A WooCommerce Point of Sale (POS) Web / CMS
  • High 8.1
    CVE-2024-13800 Public exploit

    Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it…

    Brainstorm Force ConvertPlus Web / CMS
  • Medium 6.5
    CVE-2024-50967 Public exploit

    The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability…

  • None 0.0
    CVE-2024-50633 Public exploit

    Indico Insecure Access

    A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally …

    CERN Indico indico PyPI
  • High 8.1
    CVE-2024-11848 Public exploit

    NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticate…

    NitroPack NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization Web / CMS
  • High 8.5
    CVE-2024-12365 Public exploit

    W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

    The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Sub…

    boldgrid W3 Total Cache Web / CMS
  • High 8.6
    CVE-2024-12542 Public exploit

    linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read conf…

    linkid linkID Web / CMS
  • High 7.5
    CVE-2024-11423 Public exploit

    Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

    The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable …

    WP Swings wpswings Ultimate Gift Cards for WooCommerce Gift Cards For WooCommerce Pro Web / CMS
  • High 8.6
    CVE-2024-12535 Public exploit

    Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure

    The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to re…

    eflyjason Host PHP Info Web / CMS
  • High 8.8
    CVE-2023-47179 Public exploit

    WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability

    Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through <= 2.4.6.

    mdalabar WooODT Lite
  • Medium 5.4
    CVE-2023-45828 Public exploit

    WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.

    RumbleTalk RumbleTalk Live Group Chat
  • High 7.5
    CVE-2024-56067 Public exploit EPSS 12%

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

    Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

    azzaroco WP SuperBackup
  • Low 2.1
    CVE-2024-56512 Public exploit

    Apache NiFi: Missing Complete Authorization for Parameter and Service References

    Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to …

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven
  • Medium 4.3
    CVE-2024-12955 Public exploit

    PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery

    A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as problematic. This vulnerability affects unknown code of the file /logout.php. The manipulation leads to cross-site request forgery. The attack can be initi…

    PHPGurukul Blood Bank & Donor Management System
  • High 8.8
    CVE-2024-12594 Public exploit

    ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation

    The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , Login customizer, Hide wp-login – Limit Login Attempts – Locked Site plugin for WordPress is vulnera…

    zia-imtiaz Login Page Styler – Custom WordPress Login Page Customizer & Security Web / CMS
  • Medium 6.5
    CVE-2024-12558 Public exploit

    WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db

    The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for auth…

    puckrobin WP BASE Booking of Appointments, Services and Events Web / CMS
  • Critical 9.1
    CVE-2024-54369 Public exploit

    WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability

    Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.

    ThemeHunk Zita Site Builder
  • High 8.8
    CVE-2024-54378 Public exploit

    WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.

    Quietly Quietly Insights
  • High 8.8
    CVE-2024-54379 Public exploit

    WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.

    blokhauswp Minterpress
  • Critical 9.8
    CVE-2024-54239 Public exploit

    WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.

    dugudlabs Eyewear prescription form
  • Medium 4.3
    CVE-2023-36531 Public exploit

    WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a thro…

    liquidpoll LiquidPoll – Advanced Polls for Creators and Brands
  • High 7.5
    CVE-2024-12172 Public exploit

    WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

    The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to…

    hookandhook WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses Web / CMS
  • Medium 4.3
    CVE-2023-30486 Public exploit

    WordPress Square theme <= 2.0.0 - Broken Access Control

    Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

    HashThemes Square
  • Critical 9.8
    CVE-2023-32117 Public exploit

    WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.

    SoftLab Integrate Google Drive
  • Medium 4.3
    CVE-2024-54679 Public exploit

    CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

  • High 8.8
    CVE-2024-11643 Public exploit

    Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update

    The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessible_save_settings' function in all versions up to, and includi…

    AllAccessible Accessibility by AllAccessible Web / CMS
  • Critical 9.8
    CVE-2024-10542 Public exploit EPSS 15%

    Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

    The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and includi…

    cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk Web / CMS
  • High 8.8
    CVE-2024-10728 Public exploit EPSS 39%

    PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

    The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and …

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • Critical 9.8
    CVE-2024-52382 Public exploit

    WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a through <= 1.0.0.

    medmatech Matix Popup Builder
  • High 8.8
    CVE-2024-10629 Public exploit

    GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation

    The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated at…

    axelkeller GPX Viewer Web / CMS
  • High 8.8
    CVE-2024-10674 Public exploit

    Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possib…

    ThemeHunk Th Shop Mania Web / CMS