CVE-2026-116862

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1168639.6Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This isCVE-2026-1168647.2Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.CVE-2026-1168657.2Editor PHP Object Injection in Zippy <= 1.7.0 versions.CVE-2026-1168668.8Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.CVE-2026-1168678.8Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.CVE-2026-1168688.8Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.CVE-2026-1168697.2Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.CVE-2026-116878.8Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via CVE-2026-1168708.7In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from CVE-2026-1168717.5Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that procesCVE-2026-1168727.5Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allCVE-2026-1168737.3Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthentica
CVE-2026-116862: High severity, CVSS 7.5 | Vulnix