Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56256] Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive O…

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, by…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56223] Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-us…

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and ga…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56231] Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST …

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder comma…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56232] Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys pr…

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-56237] Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mecha…

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56244] Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST du…

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12242] The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions…

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This make…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2025-71354] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.Object…

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2025-71361] picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle…

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56052] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-7761] The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link D…

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post_id), 11, 5), (2) a strstr() parsing logic flaw in post_data() th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9643] The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting vi…

The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9709] The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST …

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone W…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9710] The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-p…

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co C…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9178] The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up…

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a '…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-4297] The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in al…

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authori…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12095] The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response d…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12100] The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

nvdaltovulnerabilidad CVSS 7.2 NVD