Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: tanvirahmed1984 Clear all filters
TI-2025-11148 CVE-2025-12158 · GHSA-cw7m-pr9p-fp7m

Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

Priority MEDIUM 49

The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00452 Published 2025-11-04 No fix listed CWE-862
TI-2025-11147 CVE-2025-12157 · GHSA-mjm5-cr6q-x25r

Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset

Priority LOW 30

The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and inc…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00289 Published 2025-11-04 No fix listed CWE-862