CVE-2026-105993

MediumCVSS 5.3/10Last modified Nov 4, 2026

Description

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownDT Directory Lite Addon<= 1.1

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1059947.7ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attackerCVE-2026-1059955.3The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing CVE-2026-1059964.8The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriviCVE-2026-1059975.3The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipCVE-2026-1059985.3The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscriCVE-2026-1059995.3The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in CVE-2026-10605.3The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /CVE-2026-106004.3Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumptioCVE-2026-1060005.3The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured CVE-2026-1060025.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-managCVE-2026-1060035.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its ACVE-2026-1060045.3The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated at
CVE-2026-105993: Medium severity, CVSS 5.3 | Vulnix