#REST API
All CosmicBytez Labs articles tagged #REST API, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-103694: Mobile Builder Plugin Lets Any Registered User Become a WordPress Administrator
Mobile builder ≤ 1.4.2 fails to restrict which user meta keys a logged-in user can update via REST, enabling self-promotion to admin.
- Security
CVE-2026-14281: Unauthenticated Admin Takeover in WAWP WooCommerce Plugin
Missing REST permission checks in the WAWP plugin (≤4.8.6) let anyone register as a WordPress administrator via signup. CVSS 9.8, PoC public.
- Security
rust-iot-platform: Missing Auth Guards Expose the Entire User-Management API (CVE-2026-82452)
CVE-2026-82452 (CVSS 9.8): rust-iot-platform's REST API lacks auth checks — anyone can create, edit, or delete accounts, no login required.
- Security
CVE-2026-16149: Security Hardener WordPress Plugin Bypasses All REST API Authorization
Security Hardener plugin up to 2.4.4 overwrites REST endpoint permissions via rest_endpoints filter, bypassing all registered auth callbacks.
- Security
CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
- Security
CVE-2026-4290: WP Travel Pro Arbitrary User Deletion via Broken REST API Access Control
A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...
- Security
CVE-2026-45083 — Goobi Viewer Unauthenticated RCE via Solr Streaming Expression Injection
CVSS 9.8 in Goobi Viewer REST API lets unauthenticated clients inject Solr streaming expressions, enabling RCE on affected digital heritage platforms.
- Security
CVE-2026-20223: Cisco Secure Workload REST API Auth Bypass
A CVSS 10.0 authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to access internal REST APIs with full Site Admin privileges.
- Security
CVE-2026-45053: CubeCart REST API Arbitrary PHP File Upload
A critical arbitrary file upload vulnerability in CubeCart's REST API File Manager allows holders of a files:rw API key to upload PHP webshells to the web...
- Security
CVE-2021-47933: WordPress MStore API 2.0.6 Arbitrary File
MStore API 2.0.6 for WordPress allows unauthenticated attackers to upload arbitrary PHP files via the REST API config_file endpoint, achieving remote code...
- Security
CVE-2026-1830: WordPress Quick Playground Plugin RCE via Unauthenticated File Upload
A critical CVSS 9.8 vulnerability in the Quick Playground WordPress plugin (versions up to 1.3.1) allows unauthenticated attackers to upload arbitrary...