CVE-2026-74943

Published Aug 18, 2026

Last updated 16 hours ago

WordPress

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-74943 describes a vulnerability found in the "Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content" WordPress plugin, specifically in versions prior to 2.8.4. This flaw allows unauthenticated users to bypass the sitewide password protection. The vulnerability stems from an insufficient restriction of REST API access for authenticated users when a particular option is enabled. This oversight permits unauthenticated visitors to read content that should otherwise be protected, including account identifiers, by directly accessing the REST API. This issue is a re-introduction of a previously patched vulnerability, CVE-2024-0437, which was initially fixed in version 2.6.7 but reappeared in version 2.6.8 of the plugin.

Description
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Source
security@mozilla.org
NVD status
Undergoing Analysis

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

10

  1. الحمدلله باركوا لي طلعت 3 CVE في Firefox Browser CVE-2026-74943 CVE-2026-74945 CVE-2026-74970 There are 2 more CVEs coming بيجيكم اطلق write up #Firefox #CVE #bugzilla #mozilla #browser #infosec #secinfo

    @DS4_

    17 Aug 2026

    5870 Impressions

    0 Retweets

    121 Likes

    43 Bookmarks

    24 Replies

    0 Quotes

Related CVEs

  1. The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.•CVE-2026-15826
  2. WordPress Core Interpretation Conflict Vulnerability•CVE-2026-63030
  3. WordPress Core SQL Injection Vulnerability•CVE-2026-60137
  4. The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.•CVE-2026-3985
  5. The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.5.0.4. This is due to insufficient input sanitization and output escaping in the prepareCellOutput() method of the LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, given that they can trick an Administrator into importing data from an attacker-controlled source and the affected column types (Link, Image, or Email) are configured.•CVE-2026-5721

References

Sources include official advisories and independent security research.