Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:29:50 +0000 CVE-2026-1984 — Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta… https://vulnerability.circl.lu/vuln/cve-2026-1984 <p><strong>Affected:</strong> vowelweb Ibtana – Ecommerce Product Addons</p> <p>The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the &#39;iepa_use_gt_editor&#39; AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the &#39;iepa_builder&#39; meta key.</p> <p><strong>Affected:</strong> vowelweb Ibtana – Ecommerce Product Addons</p> <p>The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the &#39;iepa_use_gt_editor&#39; AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the &#39;iepa_builder&#39; meta key.</p> https://vulnerability.circl.lu/vuln/cve-2026-1984