GitLab Unauthenticated Arbitrary File Read (CVE-2026-85706)

🕵️ RESEARCH & DEEP DIVES

• WPBot WordPress plugin before 8.6.0 leaks chat visitor PII to unauthenticated attackers (CVE-2026-87916)
  The WPBot WordPress plugin before 8.6.0 exposes chat visitors' personal data to unauthenticated attackers.

  • Affects WordPress sites running the WPBot plugin versions 8.4.9 through 8.5.9; fixed in 8.6.0.
  • An AJAX action listing stored chat sessions lacks capability and nonce checks.
  • Unauthenticated attackers can retrieve chat visitors' names, email addresses, and phone numbers by requesting a wide date range.
  • Vulnerability classified as CWE-200 information exposure; discovered by Seongwon Lee, coordinated by WPScan.
  Sources 📄 Source: wpscan.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Rox Appointment Booking WordPress plugin before 1.2.0 vulnerable to unauthenticated price manipulation
  The Rox Appointment Booking WordPress plugin before 1.2.0 lets unauthenticated attackers create confirmed bookings at arbitrary prices and bypass payment-method restrictions.

  • Affects WordPress sites running the Rox Appointment Booking plugin, all versions before 1.2.0.
  • Booking creation does not verify order total or selected payment method against server-side pricing (CWE-284 improper access control).
  • Unauthenticated attackers can create confirmed bookings at an arbitrary price and bypass the site's configured payment-method restrictions.
  • Tracked as CVE-2026-87892; found by Morato Antoine, coordinated by WPScan.
  Sources 📄 Source: wpscan.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• YayPricing WordPress plugin before 3.5.7: Subscriber+ stored XSS via save_page_data REST route (CVE-2026-87888)
  The YayPricing WordPress plugin before 3.5.7 has a stored XSS flaw via an unauthorized REST route, tracked as CVE-2026-87888.

  • Affects WordPress sites running the YayPricing plugin in any version before 3.5.7.
  • The save_page_data REST route, which saves pricing rules, lacks an authorization check.
  • Any user with subscriber role or above can store JavaScript via this route.
  • The injected script executes in the browser of an administrator who opens the plugin's settings page.
  • Classified as CWE-79 cross-site scripting; reported by WPScan, credited to Artus KG.
  Sources 📄 Source: wpscan.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Product XML Feed Manager for WooCommerce before 3.1.1 - Contributor+ Arbitrary Pro... (5) — <https://cve.threatint.com/CVE/CVE-2026-87919?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WPBot before 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actio... (5) — <https://cve.threatint.com/CVE/CVE-2026-87918?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosu... (5) — <https://cve.threatint.com/CVE/CVE-2026-87894?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Rox Appointment Booking before 1.2.0 - Unauthenticated Holiday Schedule Modificati... (5) — <https://cve.threatint.com/CVE/CVE-2026-87891?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Zonify before 1.0.5 - Unauthenticated Account Login Token DisclosureThe Zonify Wor... (5) — <https://cve.threatint.com/CVE/CVE-2026-87842?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Client Invoicing by Sprout Invoices before 20.8.16 - Subscriber+ Private Note Over... (5) — <https://cve.threatint.com/CVE/CVE-2026-87797?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Add User Autocomplete before 1.2 - Subscriber+ Privilege EscalationThe Add User Au... (5) — <https://cve.threatint.com/CVE/CVE-2026-87759?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WP Highlight Box through 1.0 - Contributor+ Stored XSS via highlight-box Shortcode... (5) — <https://cve.threatint.com/CVE/CVE-2026-86790?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WP Component through 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Bl... (5) — <https://cve.threatint.com/CVE/CVE-2026-85681?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WP Images Upload on Piclect through 1.0 - Unauthenticated Arbitrary File UploadThe... (5) — <https://cve.threatint.com/CVE/CVE-2026-84171?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• IDB Ecommerce (wpStoreCart 5) through 5.0.7 - Unauthenticated PHP Object Injection... (5) — <https://cve.threatint.com/CVE/CVE-2026-84099?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Album Cover Finder through 0.7.0 - Unauthenticated SQLi via and_actionThe Album Co... (5) — <https://cve.threatint.com/CVE/CVE-2026-84047?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• BEAR - Bulk Editor and Products Manager Professional for WooCommerce before 1.2.2 ... (5) — <https://cve.threatint.com/CVE/CVE-2026-84025?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR... (5) — <https://cve.threatint.com/CVE/CVE-2026-82851?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• In observing arcades and their patrons, you really start to understand how destructive pinball was to young men during... (5) — <https://infosec.exchange/@SwiftOnSecurity/117256657274581753|@SwiftOnSecurity@infosec.exchange>

• GitLab Unauthenticated Arbitrary File Read (CVE-2026-85706) (5) — <https://www.thehackerwire.com/gitlab-unauthenticated-arbitrary-file-read-cve-2026-85706/|thehackerwire.com (discovered)>

• Cybersecurity May Be AI’s Next Compute Market (5) — <https://securityboulevard.com/2026/09/cybersecurity-may-be-ais-next-compute-market/|securityboulevard.com (discovered)>