CVE-2026-12082

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1208204.3MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are c CVE-2026-1208216.5A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipel CVE-2026-1208226.7MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because t CVE-2026-1208234.3A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an ac CVE-2026-1208248.8A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document CVE-2026-1208256.5An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privile CVE-2026-1208266.5An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write CVE-2026-1208287.5A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that CVE-2026-120838.1The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perf CVE-2026-1208307.4A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet wa CVE-2026-1208316.5A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted CVE-2026-1208326.5Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceCl