Aarush Gaur

The WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection plugin for WordPress contains a weak authentication flaw that allows authentication abuse. Authenticated attackers with Subscriber-level access or higher can bypass account lockouts intended to prevent brute force attacks.

A missing authorization issue exists due to a lack of capability checks in a function. This allows unauthenticated attackers to exploit incorrectly configured access control security levels to perform unauthorized actions.

Incorrectly configured access control security levels in the Dokan AI Powered WooCommerce Multivendor Marketplace Solution for WordPress allow unauthorized access. This occurs due to a missing capability check in a function, enabling unauthenticated attackers to perform unauthorized actions.

A missing authorization check in a function allows authenticated users with subscriber-level access and above to perform unauthorized actions, potentially leading to the lifting of sensitive data embedded in the cache.