Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

10,637 results · Feed

  • High 7.5
    CVE-2026-39490

    WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

    artbees JupiterX Core
  • High 7.5
    CVE-2025-68045

    WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12.

    Arraytics WP Event Solution
  • Medium 5.3
    CVE-2026-9187

    Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter

    The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, w…

    zealopensource Abandoned Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2026-6964

    Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action

    The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo…

    j_3rk Video Conferencing with Zoom Web / CMS
  • Medium 6.5
    CVE-2026-49775

    WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

    info@welcart Welcart e-Commerce
  • High 7.5
    CVE-2026-49070

    WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.

    Knit Pay Knit Pay
  • High 8.2
    CVE-2026-49065

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

    hippooo Hippoo Mobile App for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-48887

    WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

    Ahmad JS Help Desk
  • High 7.5
    CVE-2026-48883

    WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.

    wpclever WPC Product Bundles for WooCommerce Web / CMS
  • Critical 9.1
    CVE-2026-48881

    WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

    themetechmount TrueBooker
  • High 7.5
    CVE-2026-48873

    WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.

    Montonio Montonio for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-48835

    WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.

    Awesome Motive Contact Form by WPForms
  • High 7.5
    CVE-2026-42666

    WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

    Dimitri Grassi Salon booking system
  • High 8.2
    CVE-2026-42664

    WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.

    Motive Commerce Search AI Product Search for WooCommerce &#8211; Motive Commerce Search Web / CMS
  • Medium 6.5
    CVE-2026-42659

    WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

    Nasir Ahmed Advanced Form Integration
  • Medium 6.3
    CVE-2026-42651

    WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

    Mamunur Rashid Classified Listing
  • Medium 6.5
    CVE-2026-42640

    WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

    Mamunur Rashid Classified Listing
  • Medium 6.5
    CVE-2026-40794

    WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability

    Subscriber Broken Access Control in myCred <= 3.0.3 versions.

    myCred myCred
  • Medium 6.5
    CVE-2026-40795

    WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Amelia <= 2.2 versions.

    TMS Amelia
  • Medium 6.5
    CVE-2026-40793

    WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

    Groundhogg Groundhogg
  • High 7.1
    CVE-2026-40788

    WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.

    Quantum Cloud ChatBot
  • Medium 6.5
    CVE-2026-40782

    WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

    Greg Winiarski WPAdverts
  • High 7.5
    CVE-2026-40776 Public exploit

    WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.

    Arraytics WP Event Solution
  • High 7.5
    CVE-2026-40774

    WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

    SaasProject Booking Package
  • High 7.3
    CVE-2026-40775

    WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.

    Royal Plugins Royal MCP
  • Medium 6.5
    CVE-2026-40773

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability

    Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

    rtcamp rtMedia for WordPress, BuddyPress and bbPress Web / CMS
  • Medium 6.5
    CVE-2026-40743

    WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

    Themeum Tutor LMS
  • High 7.5
    CVE-2026-40741

    WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.

    Jose Conti Redsys for WooCommerce Light Web / CMS
  • Medium 6.4
    CVE-2026-39594

    WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

    themefic Ultra Addons for WPForms
  • Medium 6.5
    CVE-2026-39584

    WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability

    Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

    Webful Creations RepairBuddy
  • High 7.5
    CVE-2026-39534

    WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

    Wp Directory Kit WP Directory Kit
  • High 7.5
    CVE-2026-39533

    WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

    WPTasty AWP Classifieds
  • High 7.5
    CVE-2026-39524

    WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability

    Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

    ThemeGrill Masteriyo - LMS
  • Medium 6.5
    CVE-2026-39525

    WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

    Booking Activities Team Booking Activities
  • Medium 6.5
    CVE-2026-39515

    WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Motors < 1.4.107 versions.

    StylemixThemes Motors
  • High 7.5
    CVE-2026-39513

    WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

    Easy Appointments Easy Appointments
  • High 7.5
    CVE-2026-39503

    WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

    Awesome Motive Easy Digital Downloads
  • High 7.5
    CVE-2026-34898

    WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.

    WP Swings Event Tickets Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-34892

    WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through 1.0.271.

    Rank Math SEO Rank Math SEO
  • High 7.5
    CVE-2026-34886

    WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.

    wp.insider Simple Membership