CVE-2026-111908: phpMyFAQ
- Severity
- 8.7 (HIGH)
- Vendor
- PHPMYFAQ
- Affected versions
- 4.0.0 through before 4.1.9; 4.2.0-alpha through before 4.2.0-beta
- Fixed version
- 4.1.9
- Patch status
- Patched
- Published
- 2026-10-17T19:16:33.043
- Modified
- 2026-10-17T19:16:33.153
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
Technical summary
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
View the official NVD record for CVE-2026-111908
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
100 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-111823 |
mage-ai PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104736 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111911 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110653 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111853 |
3 Series MDO PATCH
Reporter: CVE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111884 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111901 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111908 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111923 |
fleet PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111924 |
fleet PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111927 |
coder PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111882 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111893 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-111880 |
FreeRDP PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111854 |
3 Series MDO PATCH
Reporter: CVE
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-92798 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111898 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-111895 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-111855 |
3 Series MDO PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-107762 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108123 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-110889 |
Gantry 5 Framework
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-104734 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-109208 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-103899 |
EU VAT Assistant for WooCommerce
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-96660 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-100316 |
European VAT Compliance Assistant for WooCommerce
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111110 |
Payment forms, Buy now buttons, and Invoicing System | GetPaid
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111881 |
FreeRDP PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111909 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111922 |
vikunja PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-110384 |
Fancy Comments WordPress
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-109701 |
PAYCOMET for WooCommerce
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111886 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111897 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111906 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111907 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111910 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111912 |
admidio PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111914 |
admidio PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111917 |
vikunja PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111919 |
Vikunja 0.22.0 PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111885 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111890 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111891 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111905 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111887 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111892 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111902 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111904 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111916 |
Admidio PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-109369 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-107744 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-109368 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-109985 |
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-109989 |
Themify Popup
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-111726 |
Themify Builder
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-109983 |
YMC Filter
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-111933 |
coder PATCH
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111934 |
Coder PATCH
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111601 |
Hippoo Mobile App for WooCommerce
Reporter: SECURITY
|
6.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111929 |
coder PATCH
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-110253 |
weForms – Easy Drag & Drop Contact Form Builder For WordPress
Reporter: SECURITY
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2024-58398 |
Coder 2.3.1 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111889 |
phpMyFAQ from 4.1.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111900 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111913 |
Admidio from 5.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111918 |
Vikunja from 1.0.0-rc0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111920 |
vikunja
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111921 |
Vikunja 0.13.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111928 |
Coder from 2.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111930 |
Coder from 2.26.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111931 |
Coder from 2.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111888 |
phpMyFAQ from 4.0.0 PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111894 |
phpMyFAQ 3.2.1 PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111896 |
phpMyFAQ from 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111903 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-107752 |
Welcart e-Commerce
Reporter: SECURITY
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-110268 |
Post Export Import with Media
Reporter: SECURITY
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111926 |
Coder from 2.10.0 PATCH
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-111932 |
coder PATCH
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-107763 |
Fastcache by Host.it
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-92715 |
Tutor LMS – eLearning and online course solution PATCH
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-92978 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-110882 |
SMS Alert Order Notifications PATCH
Reporter: AUDIT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111602 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
3.7
LOW
|
VIEW RECORD |
| CVE-2025-71435 |
Coder PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-111865 |
yoloe
Reporter: CNA
|
1.9
LOW
|
VIEW RECORD |
| CVE-2026-103376 |
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-104122 |
Ukr-To-Lat
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-104246 |
Contact Form 7 Signature Addon
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-106470 |
WP Data Access PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-110527 |
WP User Manager PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-81343 |
ACF Frontend Admin by DynamiApps
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-81344 |
ACF Frontend Admin by DynamiApps
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-91074 |
BSK PDF Manager
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92431 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92432 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92433 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-97314 |
ThirstyAffiliates PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.