VulncastBriefing archive

Daily Brief - 2026-10-26

· 4 vulnerabilities · 6 min listen

▶ Listen to this briefing

CVE-2026-110285

WP Stripe Checkout

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

  • Improper Authentication
  • php
  • web application
  • wordpress plugin

CVE-2026-115214

Datawiza Proxy Auth Plugin

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

  • Authentication Bypass
  • php
  • wordpress plugin

CVE-2026-115251

Snap Creek Duplicator

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

  • Remote Code Execution
  • Insecure Authentication
  • php
  • wordpress plugin

CVE-2026-116199

high · CVSS 8.1 · Snipe-IT

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

  • Authentication Bypass
  • web application
  • sso