Vulnerabilities

TI-2025-31923 CVE-2025-50010 · GHSA-xc27-9832-jv3r

WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability

LOW 24

Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00256 Published 2025-06-20 No fix listed CWE-862

TI-2024-12453 CVE-2024-13411 · GHSA-8qpj-ggqr-96fp

Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function

LOW 28

The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00317 Published 2025-03-26 No fix listed CWE-918

TI-2022-11425 CVE-2022-28802 · GHSA-2g9m-cfmh-9r83

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included…

MEDIUM 46

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0146 Published 2022-09-21 No fix listed CWE-732

Vulnerabilities

Filters

WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability

Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included…