Skip to content
OpenAdvisories

Vendor

doctorwp

2 known vulnerabilities.

Products

Breaking News WP 1 Contact Form DB for Enfold 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-4280

    Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read

    The Breaking News WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3. This is due to the brnwp_ajax_form AJAX endpoint lacking both authorization checks and CSRF verification, combined with insufficient pat…

    doctorwp Breaking News WP Web / CMS