tag

Account-Takeover

WP Directory Kit Auto-Login Authentication Bypass to Full Site Takeover (CVE-2025-13390)

CVE-2025-13390 web Patched

CVE-2025-13390webCRITICAL 10Patched2026-07-06Simple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580)

CVE-2025-53580 web Patched

CVE-2025-53580webCRITICAL 9.8Patched2026-07-06RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)

CVE-2025-9209 web Unpatched

CVE-2025-9209webCRITICAL 9.8Unpatched2026-07-06PrestaShop Checkout Zero-Click Account Takeover via ExpressCheckout Endpoint (CVE-2025-61922)

CVE-2025-61922 web Patched

CVE-2025-61922webCRITICAL 9.1Patched2026-07-06FlowiseAI Account-Takeover via Forgot-Password Token Leak (CVE-2025-58434) EPSS 50%

CVE-2025-58434 web Patched

CVE-2025-58434webCRITICAL 9.8Patched2026-07-06Xboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912)

CVE-2026-39912 web Patched

CVE-2026-39912webCRITICAL 9.1Patched2026-07-05WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415

CVE-2026-5415 web Unverified

CVE-2026-5415webHIGH 8.8Unverified2026-07-05WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)

CVE-2026-12416, CVE-2026-12417 web Unverified

CVE-2026-12416, CVE-2026-12417webCRITICAL 9.8Unverified2026-07-05Veno File Manager 4.4.9 — Unauthenticated LFI to Superadmin Takeover (CVE-2026-37072)

CVE-2026-37072 web Unverified

CVE-2026-37072webCRITICALUnverified2026-07-05Tornet Scooter Mobile App OTP Brute Force via Missing Rate Limiting (CVE-2026-7671)

CVE-2026-7671 web Unverified

CVE-2026-7671webMEDIUMUnverified2026-07-05Strapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886

CVE-2026-27886 web Patched

CVE-2026-27886webCRITICALPatched2026-07-05SmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760) KEV RW EPSS 96%

CVE-2026-23760 web Patched

CVE-2026-23760webCRITICAL 9.3Patched2026-07-05Simple History Missing Authorization Account Takeover — CVE-2026-7459

CVE-2026-7459 web Unverified

CVE-2026-7459webHIGH 7.5Unverified2026-07-05Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)

CVE-2026-40487 / GHSA-44wg-r34q-hvfx web Patched

CVE-2026-40487 / GHSA-44wg-r34q-hvfxwebHIGH 8.9Patched2026-07-05PocketBase OAuth2 Account Pre-Hijacking (CVE-2026-44166)

CVE-2026-44166 / [GHSA-pq7p-mc74-g65w](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w) web Patched

CVE-2026-44166 / [GHSA-pq7p-mc74-g65w]webMEDIUM 6.1Patched2026-07-05LatePoint Calendar Booking Plugin Agent-to-Administrator Privilege Escalation — CVE-2026-6741

CVE-2026-6741 web Patched

CVE-2026-6741webHIGH 8.8Patched2026-07-05Kirki WordPress Plugin Password-Reset Hijack Leading to Account Takeover (CVE-2026-8206)

CVE-2026-8206 web Unverified

CVE-2026-8206webCRITICAL 9.8Unverified2026-07-05Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)

CVE-2026-10580 web Unverified

CVE-2026-10580webCRITICAL 9.8Unverified2026-07-05Gogs Organization-Name Path Traversal to RCE via Git Hooks — CVE-2026-52813

CVE-2026-52813 web Patched

CVE-2026-52813webINFOPatched2026-07-05FOSSBilling Unauthenticated API Key Config Disclosure & Password Reset Token Reuse — CVE-2026-53647

CVE-2026-53647 (also documents chained CVE-2026-53646) web Patched

CVE-2026-53647webMEDIUM 6.9Patched2026-07-05Form Notify WordPress Plugin — LINE OAuth Authentication Bypass to Account Takeover (CVE-2026-5229)

CVE-2026-5229 web Patched

CVE-2026-5229webCRITICAL 9.8Patched2026-07-05Discuz! X5.0 Race Condition + CAPTCHA-Solving Pre-Auth to RCE Chain (CVE-2026-49952)

CVE-2026-49952 (chain also referenced as KIS-2026-09, KIS-2026-10, KIS-2026-11) web Unverified

CVE-2026-49952webCRITICALUnverified2026-07-05Burst Statistics WordPress Plugin Authentication Bypass to Admin Account Takeover (CVE-2026-8181) EPSS 15%

CVE-2026-8181 web Patched

CVE-2026-8181webCRITICAL 9.8Patched2026-07-05Branda White Label & Branding Plugin Unauthenticated Account Takeover — CVE-2026-11551

CVE-2026-11551 web Patched

CVE-2026-11551webCRITICAL 9.8Patched2026-07-05Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415

CVE-2026-54415 web Patched

CVE-2026-54415webHIGH 3.1Patched2026-07-05ARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)

CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074) web Patched

CVE-2026-5076webCRITICAL 9.8Patched2026-07-05