https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:46:27.718060+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-286196 EUVD-2026-286196 2026-10-09T14:46:27.720112+00:00 EUVD-2026-286196 https://cve.radiocsirt.org/vuln/fkie_cve-2025-5190 fkie_cve-2025-5190 2026-10-09T14:46:27.720143+00:00

The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checking in the 'IS_BA_Browse_As::notice' function with the 'is_ba_original_user_COOKIEHASH' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the user id.

 https://cve.radiocsirt.org/vuln/ghsa-xp67-rfwj-p4w6 GHSA-xp67-rfwj-p4w6 2026-10-09T14:46:27.720176+00:00

The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checking in the 'IS_BA_Browse_As::notice' function with the 'is_ba_original_user_COOKIEHASH' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the user id.