WordPress Plugin Vulnerabilities

Ad Invalid Click Protector (AICP) < 1.3.1 - Missing Authorization

Description

The Ad Invalid Click Protector (AICP) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
ad-invalid-click-protector
Fixed in 1.3.1

References

CVE
CVE-2026-65445
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9ba01b-09ae-4d35-8bec-30e7673c2a20

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
ca645e45-0b53-4496-8503-f835039c9136

Timeline

Publicly Published
2026-07-27 (about 1 month ago)
Added
2026-07-29 (about 1 month ago)
Last Updated
2026-07-29 (about 1 month ago)

Other

Published
Title
Published
2026-06-23
Title
Devs Accounting < 1.2.1 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
Published
2024-08-09
Title
WP Search Analytics < 1.4.10 - Missing Authorization
Published
2025-06-05
Title
Trinity Audio < 5.20.1 - Missing Authorization
Published
2023-11-03
Title
Short URL <= 1.6.8 - Missing Authorization via multiple AJAX functions
Published
2026-06-01
Title
JTL-Connector for WooCommerce < 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions