CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - 已认证（贡献者及以上）任意文件读取 WordPress 的 AI Engine for WordPress 插件在其图片插入功能中存在一个漏洞，该漏洞允许任何具有文章编辑能力的已认证用户 （贡献者、作者、编辑、管理员）从服务器下载任意文件。该漏洞源于 lqdaiupdatepost AJAX 端点缺乏适当的能力检查，以及 insertimage 函数使用 filegetcontents 处理用户控制的 URL 时没有进行协议验证，从而允许通过 file://...

cve-2026-3359-exp

CVE-2026-3359 是 Web10 的 WordPress 插件 "Form Maker" 中存在的未经身份验证的 SQL 注入漏洞，影响所有版本直至 1.15.42 版本。 为了使用此 PoC/漏洞利用，首先通过命令 virtualenv name of your enviroment here 或 venv name of your enviroment here 设置一个虚拟环境。 完成后，通过命令 source /bin/activate 安装此代码所需的库，然后在终端中运行 pip install -r requirements.txt。...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC de CVE-2026-52715 Proof of Concept educativa de GeoLeak CVE-2026-52715, inyeccion SQL no autenticada CVSS 9.3 en el plugin GEO my WordPress = 4.5.5 para WordPress. Los parametros swlatlng y nelatlng de los limites del mapa se interpolan sin saneado en la clausula WHERE. Laboratorio...

CVE-2024-56249

🛠️ WordPress Master Toolkit 漏洞利用脚本 CVE-2024-56249 🌟 概述 该脚本利用 WordPress WPMasterToolKit 插件中的任意文件上传漏洞，允许攻击者将网页后门上传到服务器。该漏洞存在于插件版本 -un -p -fn 📋 参数 -u / --url: 目标 WordPress URL（例如 http://192.168.100.74:888/wordpress） -un / --username: WordPress 管理员用户名 -p / --password: WordPress 管理员密码 -fp / --filepath:...

sudowp-postgallery

SudoWP PostGallery（安全分支） 贡献者： SudoWP, WP Republic 原始作者： RTO GmbH 标签： 画廊, 安全, 已修补, cve-2025-13543 最低要求： 5.8 测试至： 6.7 稳定版本： 1.12.6 许可证： GPLv2 或更高版本 安全声明 这是已废弃的“PostGallery”插件的安全强化分支 。原始插件因严重安全漏洞于2025年12月2日在 WordPress.org 关闭。 原始插件链接： https://wordpress.org/plugins/postgallery/ 描述 SudoWP PostGallery...

CVE-2026-94258

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...

CVE-2026-86826

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-86827

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

CVE-2026-103692

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-103646

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

everest-backup-cve-2025-11380

CVE-2025-11380 CVE-2025-11380的概念验证代码 - Everest Backup WordPress 插件中存在未经身份验证的备份访问漏洞。 博客文章链接即将发布。...

CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin, versions before 2.8.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify that the wallet account specified in a withdrawal submission belongs to the authenticated user. This allows any authenticat...

EUVD-2026-94753

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.0 , is vulnerable to a store-wide wallet transaction disclosure. The root cause is a lack of capability checks where the plugin relies on a token obtainable by any authenticated user from a front-end page to generate repor...

EUVD-2026-94748

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

CVE-2026-86828

The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...

CVE-2026-86827 BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

CVE-2026-105260 Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...