https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T21:47:27.617314+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-19191 cnvd-2025-19191 2026-10-10T21:47:27.668239+00:00 cnvd-2025-19191 https://cve.radiocsirt.org/vuln/euvd-2026-285463 EUVD-2026-285463 2026-10-10T21:47:27.668279+00:00 EUVD-2026-285463 https://cve.radiocsirt.org/vuln/fkie_cve-2025-7664 fkie_cve-2025-7664 2026-10-10T21:47:27.668294+00:00

The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.

 https://cve.radiocsirt.org/vuln/ghsa-2vwh-54r8-6xwg GHSA-2vwh-54r8-6xwg 2026-10-10T21:47:27.668325+00:00

The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.0.2. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.