CVE-2026-9331

HighCVSS 7.1/10Last modified Sep 8, 2026

Description

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-933105.3A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation CVE-2026-933114.3A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file po CVE-2026-933124.3A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This CVE-2026-933136.3A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file pop CVE-2026-933146.3A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTru CVE-2026-933155.8When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operat CVE-2026-933167.1If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciousl CVE-2026-933175.9An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed dige CVE-2026-933187.5A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could u CVE-2026-933195.7A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause th CVE-2026-933206.0BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block oper CVE-2026-933216.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem