CVE-2026-1833

The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators.

• CWE-862

• https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579
• https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596
• https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579
• https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve

Published

Feb 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1830The Quick Playground plugin for WordPress is vulnerable to R…9.8
• CVE-2026-1831The YayMail - WooCommerce Email Customizer plugin for WordPr…2.7
• CVE-2026-1832The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge…4.3
• CVE-2026-18321Buffer overflow in NTPsec's Zyfer refclock allows local atta…4.7
• CVE-2026-18322The Smart Popup by Supsystic plugin for WordPress is vulnera…8.8
• CVE-2026-18325The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-1834The Ibtana – WordPress Website Builder plugin for WordPress …6.4
• CVE-2026-18344The Wp Responsive Thumbnail Slider plugin for WordPress is v…6.1
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18352The User Access Manager plugin for WordPress is vulnerable t…7.5
• CVE-2026-18353PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT a…8.8