Missing Authorization — CVEs by weakness type

Unclassified MEDIUM 6.5

CVE-2025-5919

The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of da…

Mitigation only

Fix from $1,600 2026-01-06

Unclassified MEDIUM 5.4

CVE-2025-13766

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion …

Mitigation only

Fix from $1,600 2026-01-06

Unclassified MEDIUM 5.3

CVE-2025-14034

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capabili…

Mitigation only

Fix from $1,600 2026-01-06

Unclassified MEDIUM 5.3

CVE-2025-11370

The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel…

Mitigation only

Fix from $1,600 2026-01-06

Unclassified MEDIUM 6.5

CVE-2025-39561

Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue a…

Mitigation only

Fix from $1,600 2026-01-05

Unclassified HIGH 7.5

CVE-2025-46255

Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue af…

Mitigation only

Fix from $1,950 2026-01-05

Unclassified HIGH 7.5

CVE-2025-68850

Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Leve…

Mitigation only

Fix from $1,950 2026-01-05

Follow My Blog Post HIGH 7.5

CVE-2025-68547

Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security…

Fix: 2.4.1+

Fix from $1,950 2026-01-05

Centreon Web MEDIUM 5.3

CVE-2025-12519

Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not …

Fix: 24.04.19 / 24.10.15+

Fix from $1,600 2026-01-05

Qoca Aim MEDIUM 6.5

CVE-2025-15235

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to…

Fix: 2.7.6+

Fix from $1,600 2026-01-05

Petlibro CRITICAL 9.8

CVE-2025-15115

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to acc…

Fix: after 1.7.31

Fix from $2,300 2026-01-04

Casaos MEDIUM 5.3

CVE-2025-34171

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration …

Fix: after 0.4.15

Fix from $1,600 2026-01-02

Unclassified MEDIUM 5.3

CVE-2025-14047

The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress…

Mitigation only

Fix from $1,600 2026-01-02

Online Course Registration HIGH 8.8

CVE-2025-15406

A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authoriz…

Fix: after 3.1

Fix from $1,950 2026-01-01

Phpems HIGH 8.8

CVE-2025-15405

A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forger…

Fix: after 11.0

Fix from $1,950 2026-01-01

Unclassified MEDIUM 5.4

CVE-2025-66144

Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Securi…

Mitigation only