WordPress Plugin Vulnerabilities

Falcon – WordPress Optimizations & Tweaks < 2.10.1 - Missing Authorization

Description

The Falcon – WordPress Optimizations & Tweaks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.10.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
falcon
Fixed in 2.10.1

References

CVE
CVE-2026-59531
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7d09d1-bbc7-417c-bb3c-30f9ffe49522

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
a72a1325-372e-45a7-bfc3-df77193188ad

Timeline

Publicly Published
2026-07-23 (about 2 months ago)
Added
2026-07-29 (about 2 months ago)
Last Updated
2026-07-29 (about 2 months ago)

Other

Published
Title
Published
2025-06-27
Title
CMS Blocks <= 1.1 - Missing Authorization
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_starred()
Published
2025-09-22
Title
Payrexx Payment Gateway for WooCommerce < 3.1.6 - Missing Authorization
Published
2026-07-07
Title
User Management < 1.3 - Missing Authorization to Unauthenticated Plugin Settings Modification
Published
2024-10-28
Title
Masteriyo LMS < 1.13.4 - Subscriber+ Privilege Escalation