Charles Vosburgh

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod vhost alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected.

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

Certain bundled PHP files do not prevent direct access, allowing them to initialize without their expected context. This triggers a fatal error and returns a stack trace that discloses the server's absolute filesystem paths to unauthenticated users. This Full Path Disclosure can be used to assist in further attacks against the web application.

Insufficient authorization checks on the SMTP configuration page allow users with roles below administrator to modify outbound mail delivery settings. This flaw enables authenticated attackers with custom role-level access to elevate their privileges and achieve administrator account takeover.

The one-click upgrade routine is exposed without authentication and does not restrict access to authorized users. This allows an administrator of a multisite child site, who lacks network administrator privileges, to install and execute arbitrary PHP code within the network-wide shared plugin directory.

The plugin fails to maintain paid-registration capability restrictions when the payment gateway is disconnected. If a paid registration form remains published, it continues to assign the configured role to users. This allows unauthenticated users to register and obtain a privileged administrator-equivalent role without completing the required payment.

An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated attackers to modify shipping information stored on arbitrary orders.

An improper privilege management issue exists in the `mod ssl` module. The flaw occurs when using `SSLRequire` in conjunction with file-related expressions via `ap expr` file functions, which can lead to improper privilege escalation without requiring authentication.

Improper validation of the FTP PASV reply address in the `mod proxy ftp` module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host. This occurs in forward proxy configurations when the server processes a crafted PASV response.

An authorization check is missing in an AJAX action, which allows users with a subsite administrator role on a multisite network to write and delete arbitrary files within the network's shared filesystem. This flaw can lead to remote code execution, a situation where an attacker can execute arbitrary commands on the server.

An issue exists where the plugin fails to verify if a Stripe payment object provided during a public form submission actually belongs to the plugin before processing it. This allows unauthenticated users to trigger full refunds and immediate subscription cancellations for payments generated by other applications linked to the site owner's Stripe account.

An issue exists where the plugin fails to validate the destination of a user-supplied URL before falling back to an unprotected fetch when a safe request is rejected. This allows unauthenticated visitors to perform Server-Side Request Forgery (SSRF), a technique where an attacker forces a server to make requests to internal network hosts to query or modify information from internal services and determine if those services are active based on the response.

An issue exists where the plugin fails to verify the request signature on a specific branch of its payment webhook. This lack of server-side payment verification allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without completing the actual payment process.

An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows unauthenticated users to mark their own orders as paid by using a genuine transaction from a payment sandbox they control.

Several AJAX actions do not perform proper capability checks and are instead protected by an installation-wide secret. This secret is disclosed to any user with permission to export the site. Consequently, a user with export privileges can import an arbitrary site archive to gain administrator access. This issue occurs when an administrator grants export capabilities to a role that lacks the plugin's native import capability, which is not the default configuration.

An issue exists where the plugin fails to properly verify that a front-end form submission matches the form rendered to the visitor. This allows unauthenticated users to submit data against a different registered form, enabling the modification of the title and content of the post associated with that form.

An issue exists where the plugin fails to verify if the amount and currency reported by the payment provider match the pending payment before completion. This allows unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.