Critical vulnerabilities
3 critical vulnerabilities in 3 WordPress plugins
3 vulnerabilities rated critical (CVSS 9.0 or higher) found on 7 November 2026: Authentication bypass in WordPress plugins, Privilege escalation in WordPress plugins.
- 3 critical
Authentication bypass in Naimur Email OTP Verification for WooCommerce · WordPress plugins
CVE-2026-104014
Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization
- Severity
- Critical 9.8
- Published
- 7 Nov 2026
| Software | Affected versions |
|---|---|
| Naimur Email Otp For Woocommerce (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-104014
Privilege escalation in Registration Form for WooCommerce · WordPress plugins
CVE-2026-119075
Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout
- Severity
- Critical 9.8
- Published
- 7 Nov 2026
| Software | Affected versions |
|---|---|
| Registration Form For Woocommerce (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119075
Authentication bypass in Appointment Booking · WordPress plugins
CVE-2026-118066
Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
- Severity
- Critical 9.1
- Published
- 7 Nov 2026
| Software | Affected versions |
|---|---|
| Latepoint (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-118066
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.