https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 23:42:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-7529 <p><strong>Affected:</strong> wisemattic wiseCampaign – WooCommerce Conversions Made Easy</p> <p>The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback =&gt; &#39;__return_true&#39;` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin&#39;s banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.</p> <p><strong>Affected:</strong> wisemattic wiseCampaign – WooCommerce Conversions Made Easy</p> <p>The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback =&gt; &#39;__return_true&#39;` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin&#39;s banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.</p> https://vulnerability.circl.lu/vuln/cve-2026-7529