{"vulnerability": "cve-2026-1268", "sightings": [{"uuid": "ee88c45c-006d-4aff-8f58-a322a3fc1aaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12686", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116872565768512647", "content": "Adiss Biloop v6.1.1: CRITICAL CVE-2026-12686 enables authenticated users to bypass authorization via manipulated company ID, exposing cross-tenant data. Monitor logs and limit exposure while awaiting patch. https://radar.offseq.com/threat/cve-2026-12686-cwe-639-authorization-bypass-throug-3166bcbbfec7c2c9 #OffSeq #CVE202612686 #infosec #vuln", "creation_timestamp": "2026-07-06T10:30:28.977091Z"}, {"uuid": "2d076412-4c69-48af-8fe1-df13f78fe9e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12686", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpxv3qz2ph2g", "content": "CRITICAL vuln in Adiss Biloop v6.1.1: Authenticated users can access and modify other tenants\u2019 data via company ID parameter manipulation. Review and tighten access controls. https://radar.offseq.com/threat/cve-2026-12686-cwe-639-authorization-bypass-throug-3166bcbbfec7c2c9 #OffSeq #CVE202612686 ...", "creation_timestamp": "2026-07-06T10:30:30.845383Z"}, {"uuid": "ea396b7e-fb4c-4c05-90a4-756babfebf53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12686", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpy2k7rycx2i", "content": "CVE-2026-12686\nAdobe Commerce does not properly check user access to company data, which means an authenticated user could see or change sensitive information from other companies hosted on the same website. This could lead\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-06T12:08:04.530185Z"}, {"uuid": "b25b96d0-db31-43e0-aa23-11733c5246e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12686", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2rdjfhx2q", "content": "CVE-2026-12686 - Incorrect authorisation in Adiss\u2019s Biloop\nCVE ID : CVE-2026-12686\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised acce...", "creation_timestamp": "2026-07-06T12:12:06.065584Z"}, {"uuid": "992da49d-b3e4-494a-b92b-898287816325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12685", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116894507132740931", "content": "CVE-2026-12685 | EscortWP \u22643.6.2: CRITICAL backdoor (CWE-912) enables unauthenticated data wipe & exfiltrates site/admin info via hard-coded key. No patch available \u2014 replace theme & monitor vendor. https://radar.offseq.com/threat/cve-2026-12685-cwe-912-hidden-functionality-in-esc-2444ba57a4fc890e #OffSeq #WordPress #Infosec #CVE2026_12685", "creation_timestamp": "2026-07-10T07:30:27.754406Z"}, {"uuid": "bc5d3ee8-36ed-407d-b8c7-e81c97f8170b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12685", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqbmvjqo2j2d", "content": "EscortWP theme \u22643.6.2 hit by CRITICAL hidden backdoor (CVE-2026-12685): attackers with a hard-coded key can delete all content & exfiltrate admin data. Switch themes & stay alert for patches. https://radar.offseq.com/threat/cve-2026-12685-cwe-912-hidden-functionality-in-esc-2444ba57a4fc890e #OffS...", "creation_timestamp": "2026-07-10T07:30:29.504569Z"}, {"uuid": "4e5461fa-40f7-4896-9d8f-d8fad1f09920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12685", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqbp4i6yyn24", "content": "CVE-2026-12685 - EscortWP\nCVE ID : CVE-2026-12685\n \n Published : July 10, 2026, 7:16 a.m. | 32\u00a0minutes ago\n \n Description : The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who...", "creation_timestamp": "2026-07-10T08:10:09.756936Z"}, {"uuid": "52277cf6-1f8d-4c6b-9d24-701f6e585a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12685", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbxcnrpmr27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-12685 \u0432 \u0442\u0435\u043c\u0435 EscortWP \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D1325B54-5074-4DD5-BD79-239A74C0AB63", "creation_timestamp": "2026-07-10T10:36:47.173059Z"}, {"uuid": "fa085cff-05f6-4c39-bc0b-5326585cb48d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12685", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd5qfh2l52w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-12685 \u0432 \u0442\u0435\u043c\u0435 EscortWP \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/5991D9F5-4952-4EC7-A753-60018EF1FF3C", "creation_timestamp": "2026-07-10T22:04:30.188878Z"}, {"uuid": "d4ab521e-7991-4459-8446-513a1e0d04fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12685", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhr3bai2k2c", "content": "\ud83d\udfe0 CVE-2026-12685 - High (7.5)\n\nThe EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfus...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-12685/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T18:01:15.387926Z"}, {"uuid": "e6d03923-5f04-40e6-b784-34a6bc68e2c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12684", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqqshgmjzo2h", "content": "CVE-2026-12684 - Customer Reviews for WooCommerce\nCVE ID : CVE-2026-12684\n \n Published : July 16, 2026, 7:16 a.m. | 18\u00a0minutes ago\n \n Description : The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks...", "creation_timestamp": "2026-07-16T08:19:54.357406Z"}]}