🕵️ RESEARCH & DEEP DIVES
Login with QR WordPress plugin through 1.0.0 vulnerable to unauthenticated auth bypass (CVE-2026-86710)
The Login with QR WordPress plugin through 1.0.0 allows unauthenticated attackers to log in as any user.- Applies to WordPress sites running the Login with QR plugin, all versions through 1.0.0 (CVE-2026-86710, CWE-287).
- The plugin does not verify that a login code was issued by it, matching any stored user metadata value instead.
- Unauthenticated attackers can log in as any user, including administrators.
- Vulnerability found by Naoki Kawahigashi, coordinated by WPScan.
Private Feed Key WordPress plugin through 0.1 allows unauthenticated login as any user (CVE-2026-86707)
The Private Feed Key WordPress plugin through 0.1 lets unauthenticated attackers log in as any user, including administrators.- Affects WordPress sites running the Private Feed Key plugin, all versions through 0.1.
- The plugin fails to verify that a feed authentication key is one it issued, matching any stored user metadata value instead (CWE-287).
- This allows unauthenticated attackers to authenticate as any user, including administrators.
- Tracked as CVE-2026-86707; found by Naoki Kawahigashi and coordinated by WPScan.
Four gaps an IRM program was never built to close
A Security Boulevard commentary outlines four risk gaps that Integrated Risk Management programs leave uncovered.- Applies to teams running IRM programs, particularly ServiceNow-based deployments.
- Clean quarterly assessments can create a false sense of coverage.
- The article presents a buyer's checklist of four gaps a ServiceNow IRM program leaves open.
🕵️ RESEARCH & DEEP DIVES
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day — SecurityWeek
Event Booking Manager for WooCommerce before 5.6.0 - Contributor+ Payment Gateway ... — CVE ThreatInt
Motors before 1.4.121 - Unauthenticated Draft/Private Listing DisclosureThe Motors... — CVE ThreatInt
Master Addons for Elementor before 3.1.9 - Unauthenticated Popup Deactivation via ... — CVE ThreatInt
Realtyna Organic IDX plugin + WPL Real Estate before 5.4.2 - Reflected XSS via Loc... — CVE ThreatInt
EWWW Image Optimizer before 8.7.7 - Author+ Stored XSS via Image Class Attribute B... — CVE ThreatInt
Invisible Anti-Spam & CAPTCHA before 5.1.1 - Subscriber+ Arbitrary Form Submission... — CVE ThreatInt
Active Products Tables for WooCommerce before 2.1.3 - Subscriber+ Arbitrary Post T... — CVE ThreatInt
Event Booking Manager for WooCommerce before 5.3.8 - Unauthenticated Attendee PII ... — CVE ThreatInt
Autopay before 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disc... — CVE ThreatInt
Paid Member Subscriptions before 3.0.9 - Unauthenticated Membership Payment Bypass... — CVE ThreatInt
PuppyFW through 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Lea... — CVE ThreatInt
wpShopGermany IT-RECHT KANZLEI before 2.4 - Unauthenticated RCE via Predictable AP... — CVE ThreatInt
Dictionary through 1.0 - Unauthenticated Stored XSS via Direct Dictionary UpdateTh... — CVE ThreatInt
Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via ... — CVE ThreatInt
Dewa Kirim through 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesThe ... — CVE ThreatInt
Newsletter before 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modificati... — CVE ThreatInt
HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagThe H... — CVE ThreatInt
The Pressengine through 1.0 - Unauthenticated Authentication BypassThe Pressengine... — CVE ThreatInt
Fragnesia primitive via Open vSwitch. Deterministic local privilege escalation. — r/netsec