Tag
#WordPress Plugin
CVE-2026-91078: TillKit WordPress Plugin Vulnerability Exposes Sensitive Data
The TillKit WordPress plugin before version 1.0.5 has a critical vulnerability that allows unauthenticated attackers to gain a privileged POS session, leading to potential data breaches and unauthorized modifications. This vulnerability has a CVSS score of 8.2, indicating high severity. The flaw stems from the plugin's use of a hard-coded, publicly known PIN for the POS account without requiring a change before use.
Understanding and Defending Against CVE-2026-16030: MStore API WordPress Plugin Vulnerability
The MStore API WordPress plugin before version 4.21.0 is vulnerable to token forgery, allowing unauthenticated attackers to take over user accounts, including administrator accounts, by forging a token if they know a registered user's phone number. This vulnerability has a CVSS score of 8.1, indicating high severity. Understanding the root cause, attack surface, and exploitation mechanics is crucial for defenders to implement effective mitigations and detections.
CVE-2026-65508: Unauthenticated SQL Injection in Simply Schedule Appointments Plugin
A critical vulnerability (CVE-2026-65508, CVSS 9.3) was discovered in the Simply Schedule Appointments plugin (versions <= 1.6.12.10) for WordPress, allowing unauthenticated SQL injection. This flaw can be exploited remotely without authentication, posing a significant risk to affected installations. Immediate action is required to update to a patched version.
Understanding and Defending Against Unauthenticated SQL Injection in GeoDirectory
This educational analysis covers CVE-2026-54831, an unauthenticated SQL injection vulnerability in the GeoDirectory WordPress plugin versions up to 2.8.162. The vulnerability has a CVSS score of 9.3, indicating critical severity. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection, and defense strategies.