https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:14:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335440 EUVD-2026-335440 https://cve.radiocsirt.org/vuln/euvd-2026-335440 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4275 <p>The Divi Torque Lite – Divi Theme, Divi Builder &amp; Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of &#39;__return_true&#39; as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress&#39;s built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator&#39;s browser will pass the capability check via the admin&#39;s session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.</p> <p>The Divi Torque Lite – Divi Theme, Divi Builder &amp; Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of &#39;__return_true&#39; as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress&#39;s built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator&#39;s browser will pass the capability check via the admin&#39;s session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-4275 https://cve.radiocsirt.org/vuln/ghsa-ggxj-99vw-g2xw <p>The Divi Torque Lite – Divi Theme, Divi Builder &amp; Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of &#39;__return_true&#39; as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress&#39;s built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator&#39;s browser will pass the capability check via the admin&#39;s session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.</p> <p>The Divi Torque Lite – Divi Theme, Divi Builder &amp; Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of &#39;__return_true&#39; as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress&#39;s built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator&#39;s browser will pass the capability check via the admin&#39;s session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.</p> https://cve.radiocsirt.org/vuln/ghsa-ggxj-99vw-g2xw