Ria Labs

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.

🚨 CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database. 🎖@cveNotify

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

**Name of the Vulnerable Software and Affected Versions** Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 **Description** An authentication bypass exists because the `handle email otp return()` function returns a secret magic login token directly in the response of a publicly accessible OTP request instead of sending it exclusively to the user's email. This allows unauthenticated attackers to gain access to any account, including administrator accounts, provided they know the target user's email address. **Recommendations** Update the plugin to a version newer than 4.8.6. As a temporary mitigation, restrict access to the `handle email otp return()` function.