CVE-2026-89050

MediumCVSS 4.3/10Last modified Sep 14, 2026

Description

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Sep 13, 2026
Last modified
Sep 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-890517.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadCVE-2026-890525.9A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devCVE-2026-890548.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy forCVE-2026-890559.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.CVE-2026-890576.8A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unaCVE-2026-890587.4A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in tCVE-2026-890597.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the decCVE-2026-89066.1The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to mCVE-2026-890607.7A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedCVE-2026-890625.5A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated useCVE-2026-890637.5The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all CVE-2026-890645.3The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and inclu
CVE-2026-89050: Medium severity, CVSS 4.3 | Vulnix