CVE-2026-12894

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.

The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function. An authenticated attacker with Subscriber-level access or above can delete arbitrary calendar notes belonging to any calendar.

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin in versions up to and including 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. The checkout field is insufficiently sanitized and passed to unserialize() without validation, allowing unauthenticated attackers to execute code on the server.

The pow-auth Assent library's Sign in with Apple strategy trusts the browser-supplied 'user' parameter, which the client controls. That parameter is merged over the verified ID token claims, allowing an unauthenticated remote attacker to impersonate another user. Affects versions from 0.1.25 before 0.3.2.