Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-32648 KEV | october/system | Account Takeover in Octobercms | high | 8.2 | 90% |
| CVE-2018-12613 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Authentication | high | 8.8 | 98% |
| CVE-2018-3810 | smart-google-code-inserter (WordPress plugin) | Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker | critical | 9.8 | 91% |
| CVE-2023-28121 | woocommerce-payments (WordPress plugin), woopayments (WordPress plugin) | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on beha | critical | 9.8 | 87% |
| CVE-2014-4725 | wysija-newsletters (WordPress plugin) | The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute | high | 7.5 | 61% |
| CVE-2020-8771 | wp-time-capsule (WordPress plugin) | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client | critical | 9.8 | 46% |
| CVE-2018-19458 | athlon1600/php-proxy-app | Unauthenticated File Read in PHP Proxy | high | 7.5 | 33% |
| CVE-2017-16562 | userpro (WordPress plugin) | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentic | critical | 9.8 | 27% |
| CVE-2020-5777 | dweeves/magmi | Authentication bypass in MAGMI | critical | 9.8 | 23% |
| CVE-2021-24175 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authe | critical | 9.8 | 14% |
| CVE-2021-26598 | impresscms/impresscms | Incorrect Access Control in ImpressCMS | medium | 5.3 | 11% |
| CVE-2021-24647 | pie-register (WordPress plugin) | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1. | high | 8.1 | 10% |
| CVE-2014-0166 | WordPress core | The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi | medium | 6.4 | 9% |
| CVE-2021-24527 | profile-builder (WordPress plugin) | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of th | critical | 9.8 | 9% |
| CVE-2021-39165 | cachethq/cachet | Unauthenticated SQL Injection in Cachet | high | 8.1 | 8% |
| CVE-2017-6104 | zen-mobile-app-native (WordPress plugin) | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. | high | 7.5 | 7% |
| CVE-2021-4073 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if t | critical | 9.8 | 7% |
| CVE-2023-2437 | userpro (WordPress plugin) | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient | critical | 9.8 | 7% |
| CVE-2009-2334 | WordPress core | wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of | medium | 4.9 | 6% |
| CVE-2008-1930 | WordPress core | The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allow | high | 7.5 | 5% |
| CVE-2020-7995 | dolibarr/dolibarr | Dolibarr Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 5% |
| CVE-2016-2403 | symfony/security, symfony/security-core, symfony/symfony | Symfony Authentication Bypass | critical | 9.8 | 4% |
| CVE-2018-8710 | woocommerce-products-filter (WordPress plugin) | A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrate | critical | 9.8 | 4% |
| CVE-2022-3477 | newsmag (WordPress plugin), newspaper (WordPress plugin), tagdiv-composer (WordPress plugin) | The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5. | critical | 9.8 | 4% |
| CVE-2013-4454 | portable-phpmyadmin (WordPress plugin) | WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities | critical | 9.1 | 4% |
| CVE-2021-24148 | mstore-api (WordPress plugin) | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allow | critical | 9.8 | 3% |
| CVE-2021-25036 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audi | high | 8.8 | 3% |
| CVE-2014-0214 | moodle/moodle | Moodle creates a MoodleMobile web-service token with an infinite lifetime | medium | 0.0 | 3% |
| CVE-2013-4462 | portable-phpmyadmin (WordPress plugin) | WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability | critical | 9.1 | 3% |
| CVE-2012-10001 | limit-login-attempts (WordPress plugin) | The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote | critical | 9.8 | 3% |
| CVE-2014-8088 | zendframework/zend-ldap, zendframework/zendframework, zendframework/zendframework1 | Anonymous authentication in ldap_bind() function of PHP, using null byte | medium | 0.0 | 2% |
| CVE-2019-20360 | givewp (WordPress plugin) | A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally id | high | 7.5 | 2% |
| CVE-2018-11407 | symfony/security, symfony/security-core, symfony/symfony | Symfony Authentication Bypass | critical | 9.8 | 2% |
| CVE-2014-10389 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. | critical | 9.8 | 2% |
| CVE-2021-3850 | adodb/adodb-php | Authentication Bypass in ADOdb/ADOdb | critical | 9.1 | 2% |
| CVE-2020-26511 | wpo365-login (WordPress plugin) | The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication | high | 7.5 | 2% |
| CVE-2019-8149 | magento/community-edition, magento/product-community-edition | Magento Broken authentication and session managememt | critical | 9.8 | 2% |
| CVE-2009-3635 | typo3/cms | TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential | medium | 0.0 | 2% |
| CVE-2010-4481 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to bypass authentication and obtain sensitive information | high | 0.0 | 2% |
| CVE-2018-1082 | moodle/moodle | Moodle Improper Authentication | high | 8.1 | 2% |
| CVE-2018-0505 | mediawiki/core | Mediawiki BotPassword can bypass CentralAuth's account lock | medium | 6.5 | 2% |
| CVE-2014-6288 | in2code/powermail | TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism | medium | 0.0 | 2% |
| CVE-2012-6431 | symfony/http-foundation, symfony/routing, symfony/security +1 more | Symfony Allows URI Restrictions Bypass Via Double-Encoded String | medium | 0.0 | 2% |
| CVE-2010-1613 | moodle/moodle | Moodle Session Fixation vulnerability | medium | 0.0 | 2% |
| CVE-2017-14766 | simple-student-result (WordPress plugin) | The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() fu | high | 7.5 | 2% |
| CVE-2009-0256 | typo3/cms | Authentication library in TYPO3 vulnerable to session fixation | high | 0.0 | 2% |
| CVE-2021-41129 | pterodactyl/panel | Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification | high | 8.1 | 2% |
| CVE-2023-2706 | mobile-login-woocommerce (WordPress plugin) | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when gen | high | 8.1 | 2% |
| CVE-2022-2818 | cockpit-hq/cockpit | Cockpit Content Platform vulnerable to 2FA bypass | high | 8.8 | 2% |
| CVE-2011-4628 | typo3/cms | Typo3 Authentication Bypass | critical | 9.8 | 2% |