[{"data":1,"prerenderedAt":42},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-18053":3},{"l":4,"details":22,"weitere":25,"indexierbar":10,"updated":41},{"cve":5,"status":6,"vendor":7,"product":8,"name":7,"added":9,"due":7,"ransomware":10,"published":9,"cwes":11,"cvss":13,"slug":18,"bereich":19,"schweregrad":20,"art":21,"produktLabel":8},"CVE-2026-18053","gemeldet","","MemberDash (WordPress-Plugin)","2026-11-14",false,[12],"CWE-639",{"version":14,"score":15,"severity":16,"vector":17},"3.1",8.8,"HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","cve-2026-18053","web","hoch","Zugriff auf fremde Datensätze über ihre Kennung (IDOR)",{"description":23,"refs":24},"The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` fields are iterated and directly assigned to the current member object via the `MS_Model` `__set()` magic method with no field allowlist and no capability or ownership check on the submitted `id` parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the `id` parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.",[],[26,33,37],{"cve":27,"status":6,"produktLabel":28,"vendor":7,"product":28,"art":29,"bereich":19,"schweregrad":30,"score":31,"epss":32,"added":9,"ransomware":10},"CVE-2026-126173","AutomatorWP Pro (WordPress-Plugin)","Fehlende Berechtigungsprüfung","kritisch",9.8,0.00537,{"cve":34,"status":6,"produktLabel":35,"vendor":7,"product":35,"art":36,"bereich":19,"schweregrad":30,"score":31,"epss":-1,"added":9,"ransomware":10},"CVE-2026-120522","Cloud Storage Manager for Fluent Forms (WordPress-Plugin)","Zugriff auf Dateien außerhalb des erlaubten Ordners (Path Traversal)",{"cve":38,"status":6,"produktLabel":39,"vendor":7,"product":39,"art":40,"bereich":19,"schweregrad":30,"score":31,"epss":-1,"added":9,"ransomware":10},"CVE-2026-19907","Shipo (WordPress-Plugin)","Fehlerhafte Anmeldung (Authentifizierung)","2026-11-14T19:22:19.328Z",1794684252301]