HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-7529 — The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vul...

·Source: NIST NVD

Updated:

Executive Summary

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and c

Analysis

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check. CVSS Score: 7.5. Published: 2026-08-05T14:17:15.237.

Indicators of Compromise (1)

CVE (1)
CVE-2026-7529
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 5, 2026. Verified by: NIST.

Related Threats

HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-8400 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Serv...

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

CVE-2026-8400
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-39923 — Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability...

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enfo

CVE-2026-39923
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-16442 — A flaw was found in the SAML broker component of Keycloak, which is used to mana...

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user ac

CVE-2026-16442
NIST NVD