5.3
Medium
CVE-2026-101301 The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen…
Description
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPCode 2.0 | 2.0.0 → < 2.4.0 | 2.4.0 |
Other CVEs of WPCode
The 4 CVEs of WPCode →
CVE-2023-3524
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading…
6.1
Medium
CVE-2023-1624
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be…
6.5
Medium
CVE-2023-0328
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only…
Not rated