My CVEs

• CVE-2026-14923
  A logic flaw in the plugin's REST authorization check let Contributor-level users create and overwrite arbitrary Pages they had no permission to touch.
• CVE-2026-15939
  The plugin's REST API skipped its own content-restriction rules, letting Contributor-level users read posts and pages that were supposed to be locked.
• CVE-2026-16546
  Missing authorization on an AJAX action allowed any logged-in Subscriber to remove other users' RSVPs from volunteer events.
• CVE-2026-16547
  A download endpoint didn't verify who was asking, exposing logged REST API traffic that could contain credentials or private data.
• CVE-2026-17515
  An AJAX action with no authorization or CSRF check leaked import logs and metadata tied to posts a Subscriber shouldn't be able to see.
• CVE-2026-18603
  Unauthenticated users could pull the contents of other customers' past orders by exploiting a reorder feature with no ownership check.
• CVE-2026-19073
  A REST endpoint with no authentication check exposed any customer's full order history just by supplying their email address.
• CVE-2026-19074
  An AJAX action protected only by a public nonce leaked custom field data from listings that were never meant to be public.
• CVE-2026-19077
  The plugin's bulk delete feature skipped per-post ownership checks, letting a permitted low-level user permanently delete other users' posts.
• CVE-2026-19406
  A REST endpoint failed to scope results to the requesting user, letting Contributor-level accounts see every booking on the site.
• CVE-2026-19430
  Forgeable tokens on unauthenticated REST routes let anyone list and download files from folders that were never published.
• CVE-2026-19699
  Weak capability checks on a REST endpoint let Contributor-level users pull mailing-list audience data from the site's connected marketing account.
• CVE-2026-19709
  A flawed secret comparison let unauthenticated attackers reach REST routes and read member data on sites where API keys were never generated.
• CVE-2026-19717
  Missing authorization on REST routes exposed titles, sizes and direct URLs of attachments in folders that were never made public.
• CVE-2026-19782
  An unprotected AJAX action let any logged-in Subscriber pull the email addresses of every registered user on the site.
• CVE-2026-74927
  A REST listing route with no authorization check exposed vendor contact details and payout information to unauthenticated visitors.
• CVE-2026-77693
  A file-deletion action skipped path validation entirely, letting Shop Manager-level accounts delete arbitrary files on the server.
• CVE-2026-77695
  Several AJAX actions failed to verify guest order ownership, letting anyone read, post to, or cancel messages on someone else's order.
• CVE-2026-77701
  The plugin never confirmed who owned a guest order, letting unauthenticated users file refund requests against any of them.
• CVE-2026-78125
  A REST endpoint with no authorization check let anyone enumerate order IDs and learn their payment status.
• CVE-2026-78137
  The plugin trusted a browser-supplied price on checkout, letting attackers add products to cart at whatever price they chose.
• CVE-2026-78138
  A missing capability check on an AJAX action let any logged-in user read sales-campaign configuration data they had no access to.
• CVE-2026-78139
  A REST endpoint didn't confirm subscription ownership, letting low-privilege users unsubscribe other customers from stock alerts.
• CVE-2026-79615
  A REST route skipped authorization on quiz data, letting Contributor-level users read other authors' questions and answer keys.
• CVE-2026-79621
  Unsanitized input stored before an email is sent let unauthenticated visitors inject arbitrary content into admin notification emails.

Additional Findings

• CVE-2026-XXXXX
  A recursive trust boundary collapses once the entropy of the session lattice exceeds its own observability horizon.
• CVE-2026-XXXXX
  The plugin's causal inference layer silently renegotiates privilege with itself across a thread boundary that does not exist.
• CVE-2026-XXXXX
  An emergent state-desynchronization occurs when the request lifecycle attempts to authenticate against its own shadow.
• CVE-2026-XXXXX
  The vulnerability manifests as a self-referential authorization loop that resolves before it is ever evaluated.
• CVE-2026-XXXXX
  A quantum-adjacent race condition destabilizes the plugin's belief in its own execution context.