CVE WATCH / VULNERABILITY DETAIL
CVE-2026-113584
CRITICALCVSS 9.8NVD feed
Published 6 November 2026 · tracked since 6 November 2026
Description
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standar
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-17278 CRITICAL 9.8
- CVE-2026-17167 MEDIUM 4.3
- CVE-2026-120043 HIGH 7.5
- CVE-2026-119167 HIGH 7.2
- CVE-2026-110534 MEDIUM 6.4
- CVE-2026-19803 CRITICAL 9.8
- CVE-2026-121516 MEDIUM 6.1
- CVE-2026-120739 HIGH 7.2
- CVE-2026-120677 HIGH 7.2
- CVE-2026-120560 MEDIUM 6.5