WordPress Plugin Vulnerabilities

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

Description

The plugin does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.

Proof of Concept

Affects Plugins

Plugin icon
icollect
No known fix

References

CVE
CVE-2026-77013

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
83d578d5-bd47-421b-9b17-00c41fd53aaa

Timeline

Publicly Published
2026-08-28 (about 2 days ago)
Added
2026-08-21 (about 9 days ago)
Last Updated
2026-08-21 (about 9 days ago)

Other

Published
Title
Published
2025-05-29
Title
Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published
2024-09-06
Title
Revision Manager TMC < 2.8.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Published
2026-01-24
Title
Materialis Companion < 1.3.53 - Missing Authorization
Published
2026-04-22
Title
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema < 2.3.7 - Missing Authorization
Published
2026-07-08
Title
Sprout Invoices – Client Invoicing & Estimates < 20.8.14 - Missing Authorization