CVE-2026-20589

The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.

The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

The Project Manager – AI Powered Project Management plugin for WordPress (up to 4.1.1) is vulnerable to Remote Code Execution via the 'id' parameter. The unsanitized value is concatenated into a validation rule string and then invoked as a dynamic PHP function without allowlist checks. This allows unauthenticated attackers to execute code on the server.

The Popup Builder plugin for WordPress in versions up to and including 4.4.5 does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can trash all published popups on the site with a single GET request, amplified by a second flaw in SGPopup::find() that causes the trash branch to fire against every popup simultaneously.

The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function. An authenticated attacker with Subscriber-level access or above can delete arbitrary calendar notes belonging to any calendar.

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin in versions up to and including 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. The checkout field is insufficiently sanitized and passed to unserialize() without validation, allowing unauthenticated attackers to execute code on the server.

The pow-auth Assent library's Sign in with Apple strategy trusts the browser-supplied 'user' parameter, which the client controls. That parameter is merged over the verified ID token claims, allowing an unauthenticated remote attacker to impersonate another user. Affects versions from 0.1.25 before 0.3.2.

In TAKO AI Agent for Okta prior to 3.0.1-beta, the POST /api/auth/setup endpoint allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The initial_setup function checks only the is_setup flag and requires no authentication, bootstrap token, or network restriction, and the default configuration listens on 0.0.0.0:8001.

MoLing in SSE mode (started with -l) does not authenticate requests to the /sse and /message endpoints, and the mcp-go dependency sets Access-Control-Allow-Origin: *. A malicious web page can open a cross-origin EventSource to /sse, read the sessionId, and send unauthorized MCP tool calls via /message, potentially leading to file read/write or command execution. The issue is fixed in version 0.5.0.