The WordPress 10Web AI Assistant plugin version 1.0.18 and below was prone to a broken access control vulnerability that could allow authenticated users to install plugins.

The WordPress Deeper Comments plugin is prone to an unpatched broken access control vulnerability that could allow full site takeover.

The WordPress B2BKing plugin fixed a broken access control vulnerability that could allow customers to change the price of all products.

Elementor Pro, a popular page builder plugin for WordPress, fixed a broken access control vulnerability affecting version 3.11.6 and below that could allow full site takeover.

8 WordPress plugins were prone to a high severity authenticated arbitrary plugin installation vulnerability, among other issues.