CVE-2026-90494

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.

Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.