Access Control

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query ParametersCVE-2026-4812wpengine · CVSS 5.3 · 0.9% likely

   CWE-862

2. WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes DisclosureCVE-2022-1563Wpengine · CVSS 5.3 · 0.7% likely

   CWE-284

3. Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup InterceptionCVE-2026-4031wpengine · CVSS 7.5 · 0.5% likely

   CWE-862

4. Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' ParametersCVE-2026-8382wpengine · CVSS 5.3 · 0.5% likely

   CWE-862

5. Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and DeletionCVE-2026-4030wpengine · CVSS 8.1 · 0.5% likely

   CWE-862

6. Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database ExportCVE-2026-4029wpengine · CVSS 7.5 · 0.4% likely

   CWE-862

7. WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerabilityCVE-2024-37249WPEngine Inc. · CVSS 4.3 · 0.3% likely

   CWE-862

8. WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerabilityCVE-2024-37250WPEngine Inc. · CVSS 5.4 · 0.3% likely

   CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.