CVE-2026-15141

MediumCVSS 5.7/10Last modified Oct 23, 2026

Description

The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic.

Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	TL-WR820N v2	< 1.15.20 Build 260611 Rel.29552n

References

https://www.tp-link.com/en/support/download/tl-wr820n/#FirmwareProduct
https://www.tp-link.com/en/support/faq/5243/Vendor Advisory
https://www.tp-link.com/kr/support/download/tl-wr820n/#FirmwareProduct

Timeline

Published: Aug 12, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-151427.5The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is CVE-2026-151439.3A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitra CVE-2026-151445.3@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 c CVE-2026-151456.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-151465.9GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A CVE-2026-151475.3The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, fai CVE-2026-151485.3The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configu CVE-2026-151495.3The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when CVE-2026-151505.3The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's co CVE-2026-151517.5The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowi CVE-2026-151525.3The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's o CVE-2026-151536.8The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using