Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. Act now Wordfence

   Easy Appointments

   CVE-2026-14223

   Affects you if you run Easy Appointments up to and including version 3.12.26 and have users with the subscriber role or higher on your site.

   Insufficiently protected access to customer data. A logged-in user with minimal privileges can read any customer's personal information by simply iterating through identifiers. The vulnerability is not exploitable anonymously from the outside, but anyone with an account, even a subscriber, can use it. That makes it dangerous in membership areas and on sites with open registration.

   Update to version 3.12.28. The source does not name a workaround that prevents the reading without the update.

   Affected

   Easy Appointments

   CVSS

   4.3
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   yes, user account

   Likely to be exploited

   0.21 %
   percentile 10.8

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. Act now Wordfence

   Bit Form

   CVE-2026-15054

   Affects you if you run Bit Form prior to version 3.1.2 and have forms that are deactivated or unpublished but still have workflows attached.

   Bit Form does not check whether a form is active when handling public submissions. An attacker can submit entries to a deactivated form and trigger attached workflows such as email notifications, without logging in. This is not a data leak, but it lets someone fire workflows the operator deliberately took offline.

   Update to 3.1.2.

   Affected

   Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder

   Fixed in

   3.1.2

   CVSS

   3.7
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   no

   Likely to be exploited

   0.20 %
   percentile 10.2

   Type

   CWE-862

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. Act now Wordfence

   LifterLMS

   CVE-2026-14207

   Affects you if you run LifterLMS up to version 10.0.9 and have users with the course editor role or higher.

   A course editor can place JavaScript in a course pricing field. The plugin does not strip it before saving. When an administrator views the course later, the script runs in their session. The editor can then act on behalf of the administrator, change settings, or create additional users.

   The vulnerability requires a trusted role, which keeps the CVSS score low. In learning environments with many course editors, however, trust is spread wide, and the jump from editor to administrator is short.

   Update to version 10.0.10.

   Affected

   LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes

   Fixed in

   10.0.10

   CVSS

   6.1
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   no

   Likely to be exploited

   0.19 %
   percentile 9.1

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

4. Act now Wordfence

   Tutor LMS – eLearning and online course solution

   CVE-2026-14310

   Affects you if you run Tutor LMS in a version before 4.0.0 and have courses with the Q&A feature enabled for participants.

   A flaw in the authorization check. An authenticated user with subscriber rights can read the Q&A threads of other courses and inject their own replies. Access to a single course is enough. Content meant only for specific participants is exposed, and discussions can be undermined with false answers.

   Update to version 4.0.0. The source does not provide a workaround.

   Affected

   Tutor LMS – eLearning and online course solution

   Fixed in

   4.0.0

   CVSS

   5.4
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   yes, user account

   Likely to be exploited

   0.18 %
   percentile 7.2

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

5. For the record Wordfence

   Fluent Forms

   CVE-2026-17567

   Affects you if you run Fluent Forms up to version 6.2.8 and handle payments through the form.

   An insufficiently protected access to payment receipts. An attacker can guess valid transaction hashes without logging in, because the required components such as form ID and submission ID are either observable or guessable. The weakness is in the transaction parameter, which is not sufficiently protected against brute-forcing.

   This allows viewing other customers' payment data: name, email, billing address, ordered items, payment method, and payment status. The vulnerability requires no account and is exploitable with little effort.

   Update Fluent Forms to version 6.2.9. The source does not name another fix.

   Affected

   Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

   Fixed in

   6.2.9

   CVSS

   5.3
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.38 %
   percentile 30.5

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

6. For the record Wordfence

   RegistrationMagic

   CVE-2026-15255

   Affects you if you run RegistrationMagic in a version before 6.0.9.4 and the plugin stores form data that should not fall into the wrong hands.

   The plugin does not verify that a one-time password presented in a cookie belongs to the identity whose form data is being requested. An attacker without an account can read other users' submitted data, including personal information. No active exploitation is currently known, and the likelihood of exploitation is in the low range.

   Update to version 6.0.9.4.

   Affected

   RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

   Fixed in

   6.0.9.4

   CVSS

   5.3
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   no

   Likely to be exploited

   0.20 %
   percentile 10.3

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

7. For the record Wordfence

   RegistrationMagic

   CVE-2026-15257

   Affects you if you run RegistrationMagic in a version before 6.0.9.4 and the plugin accepts form submissions from visitors.

   The plugin skips the check of whether a sender is authorized when editing form data. A stranger can overwrite other users' submitted data without logging in and change the profile fields of the associated WordPress accounts. Administrator accounts are not affected.

   The vulnerability is not on the KEV list and the likelihood of exploitation is 0.2 percent. I still classify it as awareness because it requires no login and undermines data integrity.

   Update to version 6.0.9.4.

   Affected

   RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

   Fixed in

   6.0.9.4

   CVSS

   5.3
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   no

   Likely to be exploited

   0.19 %
   percentile 8.8

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-30

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

8. Act now Wordfence

   Easy Appointments

   CVE-2026-14224

   Affects you if you run Easy Appointments up to version 3.12.26 and registered users can book their own appointments.

   An access control flaw. The plugin does not verify that the appointment targeted by its customer-data update action belongs to the current user. It relies on a shared nonce that any authenticated user can obtain from their own booking form.

   An attacker with a basic subscriber account can reuse that nonce to overwrite another appointment's name, email, phone number, and description. Because the plugin later treats this metadata as the appointment's contact data, a subsequent status change by an administrator can cause the victim's entered data to be sent to the attacker.

   Update Easy Appointments to version 3.12.28.

   Affected

   Easy Appointments

   CVSS

   5.4
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   yes, user account

   Likely to be exploited

   0.15 %
   percentile 4.3

   Type

   CWE-639

   Actively exploited

   not on the KEV list

   Published

   2026-07-29

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

9. For the record Wordfence

   Admin and Site Enhancements (ASE) Pro

   CVE-2026-16610

   Affects you if you run Admin and Site Enhancements (ASE) Pro up to and including version 8.9.0 and the [post_cf_form] shortcode is placed on at least one publicly accessible page.

   An attacker can execute arbitrary code on the server without logging in. The [post_cf_form] shortcode accepts input and passes it unchecked to a function that executes it directly. The capability check is missing, and a captcha can be bypassed.

   Update to the version that closes the vulnerability. The source does not name the fixed release, so please check with the vendor directly.

   Affected

   Admin and Site Enhancements (ASE) Pro

   Fixed in

   8.9.1

   CVSS

   9.8
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.58 %
   percentile 44.5

   Type

   CWE-434

   Actively exploited

   not on the KEV list

   Published

   2026-07-29

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

10. For the record Wordfence

    BuddyPress

    CVE-2026-1360

    Affects you if you run BuddyPress up to and including 14.5.0 and hand out subscriber-level accounts. In an active BuddyPress network, that is the norm.

    A deserialization of untrusted data in the function that reads profile fields. A logged-in user with subscriber rights can inject an arbitrary PHP object through a textbox field. Whether that turns into code execution depends on a suitable POP chain being present in the WordPress environment. That is not guaranteed, but it cannot be ruled out either.

    The vulnerability is rated 7.5 and the likelihood of exploitation is low. It still belongs on the list because an attacker only needs an account with minimal rights, and the worst case is full takeover.

    Update BuddyPress to the version that fixes the issue. No workaround is known; only the update helps.

    Affected

    BuddyPress

    CVSS

    7.5
    source security@wordfence.com

    Login required

    yes, user account

    Likely to be exploited

    0.57 %
    percentile 44.1

    Type

    CWE-502

    Actively exploited

    not on the KEV list

    Published

    2026-07-29

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.