Missing authorization in WordPress plugins

A missing authorization check means the plugin does an action without first asking “is this person allowed to do this?”. The action might change a setting, delete data, send an email or export records. WordPress gives plugins the tools to check permissions, but each plugin has to remember to use them on every action.

How bad it is depends on the action. Some of these only let a logged-in subscriber flip a harmless option. Others let a visitor with no account change settings that matter. The severity score and the “access needed” line on each plugin page tell you which kind you are looking at.

What to do: update to the fixed version. If no fix exists and the plugin is not essential, deactivate it. Turning off open registration (Settings → General → Membership) closes the door on the many records that need a logged-in user.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Missing authorization records

4,332 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

medium 4.3 Points Management System For Gamification, Ran…

Missing authorization check

CVE-2026-97072 · affected 4.0.2 and older · fixed in 4.0.3 · published 2026-11-03
medium 4.3 WCFM Membership

Missing authorization check

CVE-2026-39777 · affected 2.12.0 and older · fixed in 2.12.1 · published 2026-11-03
medium 5.3 WCFM Membership

Missing authorization check

CVE-2026-39743 · affected 2.12.0 and older · fixed in 2.12.1 · published 2026-11-03
medium 5.3 Uncanny Automator

Missing authorization check

CVE-2026-120846 · affected 7.7.1 and older · fixed in 8.0.0 · published 2026-11-03
medium 5.3 Better Search

Missing authorization check

CVE-2026-119495 · affected 4.5.2 and older · fixed in 4.5.3 · published 2026-11-03
medium 5.3 ClickCease Click Fraud Protection

Missing authorization check

CVE-2026-119509 · affected 3.3.0 and older · fixed in 3.3.1 · published 2026-11-03
medium 5.3 Dokan

Missing authorization check

CVE-2026-119487 · affected 5.3.2 and older · fixed in 5.3.3 · published 2026-11-03
medium 5.3 Dokan

Missing authorization check

CVE-2026-119485 · affected 5.3.2 and older · fixed in 5.3.3 · published 2026-11-03
medium 5.3 affects latest 1.58.3 Forminator Forms

Missing authorization check

CVE-2026-116859 · affected 1.58.3 and older · no fix listed yet · published 2026-11-03
medium 5.3 Dynific Addons for Elementor (formerly Anywher…

Missing authorization check

CVE-2026-114187 · affected 1.3.0 and older · fixed in 1.3.1 · published 2026-11-03
medium 4.3 Points Management System For Gamification, Ran…

Missing authorization check

CVE-2026-103077 · affected 4.0.2 and older · fixed in 4.0.3 · published 2026-11-03
medium 5.3 AI Alt Text Generator

Missing authorization check

CVE-2026-120578 · affected 2.7.0 and older · fixed in 2.7.1 * · published 2026-11-03
medium 5.3 JetFormBuilder

Missing authorization check

CVE-2026-120561 · affected 3.6.2 and older · fixed in 3.6.2.1 * · published 2026-11-03
medium 5.3 WP Compress

Missing authorization check

CVE-2026-120551 · affected 7.22.01 and older · fixed in 7.22.38 * · published 2026-11-03
medium 4.3 Media Library Assistant

Missing authorization check

CVE-2026-113481 · affected older than 3.44 · fixed in 3.44 · published 2026-11-01
medium 4.3 Kali Forms

Missing authorization check

CVE-2026-107343 · affected older than 2.4.30 · fixed in 2.4.30 · published 2026-11-01
medium 6.5 Redux Framework

Missing authorization check

CVE-2026-103997 · affected 4.5.15 and older · fixed in 4.5.16 * · published 2026-10-31
medium 4.3 Perfect Images

Missing authorization check

CVE-2025-11455 · affected 7.2.0 and older · fixed in 7.2.1 * · published 2026-10-31
critical 9.1 Popup Builder

Missing authorization check

CVE-2026-89270 · affected 4.4.5 and older · fixed in 4.4.6 * · published 2026-10-31
medium 5.3 Product Filter for WooCommerce by WBW

Missing authorization check

CVE-2026-11396 · affected 3.4.6 and older · fixed in 3.4.7 * · published 2026-10-31
medium 5.3 Welcart e-Commerce

Missing authorization check

CVE-2026-119166 · affected 2.12.5 and older · fixed in 2.12.6 * · published 2026-10-31
critical 9.1 WP Booking System

Missing authorization check

CVE-2026-116557 · affected 2.1.0.5 and older · fixed in 2.1.0.6 * · published 2026-10-31
medium 4.3 Hustle

Missing authorization check

CVE-2026-109386 · affected 7.8.14.3 and older · fixed in 7.8.14.4 * · published 2026-10-31
medium 6.5 Spectra Legacy

Missing authorization check

CVE-2026-92294 · affected 2.20.4 and older · fixed in 2.20.5 * · published 2026-10-31
high 7.5 Mapster WP Maps

Missing authorization check

CVE-2026-118638 · affected older than 2.0.6 · fixed in 2.0.6 · published 2026-10-31
low 3.7 BuddyForms

Missing authorization check

CVE-2026-118437 · affected 2.8.8 up to (not including) 2.10.1 · fixed in 2.10.1 · published 2026-10-31
medium 5.3 Premium Packages

Missing authorization check

CVE-2026-118184 · affected older than 7.2.2 · fixed in 7.2.2 · published 2026-10-31
medium 5.3 Booktics

Missing authorization check

CVE-2026-62122 · affected 1.0.31 and older · fixed in 1.0.32 · published 2026-10-30
medium 4.3 Bookit

Missing authorization check

CVE-2026-62019 · affected 2.6.0.6 and older · fixed in 2.6.0.7 · published 2026-10-30
medium 4.3 Event Tickets and Registration

Missing authorization check

CVE-2026-62047 · affected 5.30.2 and older · fixed in 5.30.3 · published 2026-10-30
medium 5.3 FluentCRM

Missing authorization check

CVE-2026-62056 · affected 3.2.6 and older · fixed in 3.3.0 · published 2026-10-30
medium 4.3 Unlimited Elements for Elementor

Missing authorization check

CVE-2026-62023 · affected 2.0.26 and older · fixed in 2.0.27 · published 2026-10-30
medium 6.5 Booking and Rental Manager for Bike

Missing authorization check

CVE-2026-54850 · affected 2.8.2 and older · fixed in 2.8.3 · published 2026-10-30
medium 6.5 GiveWP

Missing authorization check

CVE-2026-116853 · affected 4.19.0.1 and older · fixed in 4.19.0.2 · published 2026-10-30
high 7.5 WP REST Cache

Missing authorization check

CVE-2026-116862 · affected 2026.3.1 and older · fixed in 2026.4.0 · published 2026-10-30
medium 6.5 Masteriyo LMS

Missing authorization check

CVE-2026-116410 · affected 3.4.3 and older · fixed in 3.5.0 · published 2026-10-30
high 7.5 HUSKY

Missing authorization check

CVE-2026-116401 · affected 1.4.6 and older · fixed in 1.4.7 · published 2026-10-30
medium 5.3 YITH WooCommerce Product Add-Ons

Missing authorization check

CVE-2026-107868 · affected 4.34.0 and older · fixed in 4.34.1 · published 2026-10-30
medium 4.3 Booktics

Missing authorization check

CVE-2026-104674 · affected 1.0.31 and older · fixed in 1.0.32 · published 2026-10-30
high 7.5 Forminator Forms

Missing authorization check

CVE-2026-97638 · affected 1.57.3.1 and older · fixed in 1.58.0 * · published 2026-10-30
medium 6.5 Meow Gallery

Missing authorization check

CVE-2026-13747 · affected 5.5.4 and older · fixed in 5.5.5 * · published 2026-10-30
medium 4.3 OpenStation

Missing authorization check

CVE-2026-109592 · affected 1.1.16 and older · fixed in 1.1.17 * · published 2026-10-30
high 7.5 Email Templates Customizer and Designer for Wo…

Missing authorization check

CVE-2026-107630 · affected 1.5.14 and older · fixed in 1.5.15 * · published 2026-10-30
high 8.7 Database Cleaner

Missing authorization check

CVE-2025-8574 · affected 1.4.7 and older · fixed in 1.4.8 * · published 2026-10-30
medium 4.3 Event Tickets and Registration

Missing authorization check

CVE-2026-62055 · affected 5.30.2 and older · fixed in 5.30.3 · published 2026-10-30
medium 5.4 The Events Calendar

Missing authorization check

CVE-2026-119367 · affected 6.18.2 and older · fixed in 6.18.3 · published 2026-10-30
medium 5.4 FluentCRM

Missing authorization check

CVE-2026-62141 · affected 3.2.6 and older · fixed in 3.3.0 · published 2026-10-30
medium 5.4 Easy Appointment Booking & Scheduling Plugin

Missing authorization check

CVE-2026-116407 · affected 6.5.4 and older · fixed in 6.5.5 · published 2026-10-30
medium 5.3 JetFormBuilder

Missing authorization check

CVE-2026-119482 · affected 3.6.7.1 and older · fixed in 3.6.8 · published 2026-10-30
medium 5.3 The Events Calendar

Missing authorization check

CVE-2026-119368 · affected 6.18.2 and older · fixed in 6.18.3 · published 2026-10-30
medium 5.3 Timetics

Missing authorization check

CVE-2026-116860 · affected 1.0.65 and older · fixed in 1.0.66 · published 2026-10-30
high 7.5 AI Engine

Missing authorization check

CVE-2026-110732 · affected 3.8.6 and older · fixed in 3.8.7 * · published 2026-10-30
medium 4.3 Content Egg

Missing authorization check

CVE-2026-119087 · affected 12.0.0 and older · fixed in 12.1.0 * · published 2026-10-30
medium 4.3 Content Egg

Missing authorization check

CVE-2026-119059 · affected 12.0.0 and older · fixed in 12.1.0 * · published 2026-10-30
medium 5.3 BuddyForms

Missing authorization check

CVE-2026-118101 · affected older than 2.10.1 · fixed in 2.10.1 · published 2026-10-30
medium 5.4 Fraud Prevention For WooCommerce and EDD

Missing authorization check

CVE-2026-118072 · affected older than 2.3.6 · fixed in 2.3.6 · published 2026-10-30
medium 5.4 LearnPress

Missing authorization check

CVE-2026-42690 · affected 4.4.10 and older · fixed in 4.4.11 · published 2026-10-29
medium 6.5 Hotel Booking

Missing authorization check

CVE-2026-118084 · affected 3.8 and older · fix not stated · published 2026-10-29
medium 6.4 HappyAddons for Elementor

Missing authorization check

CVE-2026-109891 · affected 3.50.1 and older · fixed in 3.51.0 · published 2026-10-29
medium 5.3 Points Management System For Gamification, Ran…

Missing authorization check

CVE-2026-97073 · affected 4.0.2 and older · fixed in 4.0.3 · published 2026-10-29
medium 5.4 EventPrime

Missing authorization check

CVE-2026-42691 · affected 4.3.6.0 and older · fixed in 4.3.6.1 · published 2026-10-29
medium 5.3 Page and Post Restriction

Missing authorization check

CVE-2026-54852 · affected 1.6.1 and older · fixed in 1.6.2 · published 2026-10-29
medium 5.3 User Profile Builder

Missing authorization check

CVE-2026-54853 · affected 4.0.5 and older · fixed in 4.0.6 · published 2026-10-29
medium 5.3 ShopBuilder

Missing authorization check

CVE-2026-54871 · affected 3.4.2 and older · fixed in 3.4.3 · published 2026-10-29
medium 4.3 User Frontend

Missing authorization check

CVE-2026-52708 · affected 4.3.13 and older · fixed in 4.3.14 · published 2026-10-29
medium 5.3 User Frontend

Missing authorization check

CVE-2026-48884 · affected 4.3.13 and older · fixed in 4.3.14 · published 2026-10-29
medium 5.3 Kit (formerly ConvertKit)

Missing authorization check

CVE-2026-27063 · affected 3.4.7 and older · fixed in 3.4.8 · published 2026-10-29
medium 4.3 ERP

Missing authorization check

CVE-2026-25448 · affected 1.17.10 and older · fixed in 1.17.11 · published 2026-10-29
medium 5.3 User Registration & Membership

Missing authorization check

CVE-2026-25450 · affected 5.3.0 and older · fixed in 5.3.1 · published 2026-10-29
medium 4.3 MasterStudy LMS WordPress Plugin

Missing authorization check

CVE-2026-118092 · affected 3.7.55 and older · fixed in 3.7.56 · published 2026-10-29
medium 5.3 Flexible Quantity & Price Calculator for WooCo…

Missing authorization check

CVE-2026-116856 · affected 2.3.24 and older · fixed in 2.3.25 · published 2026-10-29
medium 5.3 WP User Manager

Missing authorization check

CVE-2026-116846 · affected 2.9.26 and older · fixed in 2.10.0 · published 2026-10-29
medium 5.3 WPFunnels

Missing authorization check

CVE-2026-118091 · affected 3.13.5 and older · fixed in 3.13.6 · published 2026-10-29
medium 5.3 WPFunnels

Missing authorization check

CVE-2026-118088 · affected 3.13.5 and older · fixed in 3.13.6 · published 2026-10-29
medium 5.3 SureForms

Missing authorization check

CVE-2026-116387 · affected 2.12.9 and older · fixed in 2.13.0 · published 2026-10-29
medium 4.3 Easy Appointment Booking & Scheduling Plugin

Missing authorization check

CVE-2026-116406 · affected 6.5.4 and older · fixed in 6.5.5 · published 2026-10-29
medium 5.3 Custom Price for WooCommerce

Missing authorization check

CVE-2026-115601 · affected 1.1.29 and older · fixed in 1.1.30 · published 2026-10-29
medium 4.3 SureDash

Missing authorization check

CVE-2026-115605 · affected 1.12.3 and older · fixed in 1.12.4 · published 2026-10-29
medium 5.3 E-cab Taxi Booking Manager for Woocommerce

Missing authorization check

CVE-2026-114181 · affected 2.1.6 and older · fixed in 2.1.7 · published 2026-10-29
medium 4.3 HivePress Claim Listings

Missing authorization check

CVE-2026-42707 · affected 1.1.4 and older · fixed in 1.1.5 · published 2026-10-29
medium 5.3 Kali Forms

Missing authorization check

CVE-2026-39782 · affected 2.4.27 and older · fixed in 2.4.28 · published 2026-10-29
medium 6.5 Kali Forms

Missing authorization check

CVE-2026-42703 · affected 2.4.27 and older · fixed in 2.4.28 · published 2026-10-29
medium 5.3 Simple CAPTCHA with Cloudflare Turnstile

Missing authorization check

CVE-2026-39741 · affected 1.44.0 and older · fixed in 1.44.1 · published 2026-10-29
medium 4.3 WP Job Portal

Missing authorization check

CVE-2026-22386 · affected 2.7.1 and older · fixed in 2.7.2 · published 2026-10-29
medium 5.3 Product Feed Manager for WooCommerce

Missing authorization check

CVE-2026-118093 · affected 7.14.1 and older · fixed in 7.14.2 · published 2026-10-29
medium 5.3 YITH PayPal Express Checkout for WooCommerce

Missing authorization check

CVE-2026-27401 · affected 1.62.0 and older · fixed in 1.62.1 · published 2026-10-29
high 7.1 Broadcast Live Video

Missing authorization check

CVE-2026-115963 · affected 7.3.9 and older · fixed in 7.3.12 · published 2026-10-29
high 7.5 LearnPress

Missing authorization check

CVE-2026-115599 · affected 4.4.11 and older · fixed in 4.4.12 · published 2026-10-29
high 7.5 GEO my WP

Missing authorization check

CVE-2026-114193 · affected 4.5.5.5 and older · fixed in 4.5.5.7 · published 2026-10-29
high 7.1 HANDMADE

Missing authorization check

CVE-2026-112827 · affected 1.0.10 and older · fixed in 1.0.11 · published 2026-10-29
medium 5.3 Link Library

Missing authorization check

CVE-2026-78395 · affected older than 7.10.0 · fixed in 7.10.0 · published 2026-10-29
low 3.8 Video Player for YouTube

Missing authorization check

CVE-2026-85007 · affected older than 2.1.4 · fixed in 2.1.4 · published 2026-10-29
medium 5.3 Contact Form by Supsystic

Missing authorization check

CVE-2026-115302 · affected older than 1.11.1 · fixed in 1.11.1 · published 2026-10-29
medium 4.9 Photo Engine (Media Organizer & Lightroom)

Missing authorization check

CVE-2026-115259 · affected older than 6.6.0 · fixed in 6.6.0 · published 2026-10-29
medium 4.3 Wallet System for WooCommerce

Missing authorization check

CVE-2026-108763 · affected older than 2.8.2 · fixed in 2.8.2 · published 2026-10-29
low 3.7 WP Post Author

Missing authorization check

CVE-2026-108685 · affected older than 4.2.0 · fixed in 4.2.0 · published 2026-10-29
medium 6.5 affects latest 4.5.16 Redux Framework

Missing authorization check

CVE-2026-116404 · affected 4.5.16 and older · no fix listed yet · published 2026-10-28
high 7.5 Optima Express IDX

Missing authorization check

CVE-2026-116393 · affected 9.0.0 and older · fixed in 9.0.1 * · published 2026-10-28
medium 5.4 My auctions allegro

Missing authorization check

CVE-2026-116855 · affected 4.0.3 and older · fixed in 4.0.4 · published 2026-10-28
medium 5.3 Essential Addons for Elementor

Missing authorization check

CVE-2026-110508 · affected 6.7.3 up to (not including) 6.8.7 · fixed in 6.8.7 · published 2026-10-28

Other types

Cross-site scripting (XSS) · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan