CVE-2026-21902

The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.

The 3D Product configurator plugin for WooCommerce up to version 2.16.2 is vulnerable to Remote Code Execution via the 'xpv_image' parameter. Missing authentication and nonce checks on the wp_loaded handler, combined with lack of sanitization before echoing into a Dompdf-rendered HTML template with PHP execution enabled, allow unauthenticated attackers to execute code on the server.

The Extensions For CF7 plugin up to version 3.4.5 is vulnerable to Arbitrary File Upload via the extcf7_submit function. Missing file extension, MIME type, and size validation, combined with absence of PHP-execution guards and a sanitize_file_name() bypass, allow unauthenticated attackers to upload executable files, leading to remote code execution.

The Blocksy Companion plugin up to version 2.1.58 is vulnerable to privilege escalation. The implement_user_registration() AJAX handler disables Dokan's vendor-registration nonce check and trusts an attacker-supplied $_POST['role'] value, allowing unauthenticated attackers to obtain a Dokan 'seller' account and be auto-authenticated, even when vendor signup is disabled.

The Advanced IP Blocker plugin up to version 8.13.13 is vulnerable to Authentication Bypass. The handle_login_action() function performs no server-side check that step-1 password authentication was completed, and an error branch unconditionally mints a fresh nonce for any unauthenticated caller. This allows attackers to brute-force an unthrottled 6-digit TOTP code and obtain a fully authenticated session for any 2FA-enabled account, including administrators.

In JetBrains Exposed before version 1.5.1, SQL injection was possible via unescaped string arguments of several SQL functions.

In versions prior to 0.5.0 of Remote Attestation TLS Clients for Rust and Go, RA-TLS challenge verifiers accepted quotes bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.

In versions prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, Enclave OS Virtual placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

In versions prior to privasys-v0.5.1-go1.26.5, Privasys Go (a fork of Go with RA-TLS support) in challenge mode bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.

In versions prior to privasys-v0.8.1, Privasys rustls (a fork of the rustls TLS library with RA-TLS support) emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.