EUVD-2026-92260

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin, in versions through 1.7.6 , is vulnerable to unauthenticated direct file access. The root cause is that customer-uploaded files are stored in a publicly web-accessible uploads directory where the plugin's intended access restrictions are in...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin versions before 1.7.6 contains a vulnerability where it fails to verify the identity of users requesting customer-uploaded files. This lack of authorization allows unauthenticated attackers to download files belonging to other customers if t...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-78371 File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

EUVD-2026-92261

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2021-29447-PoC

CVE-2021-29447-PoC Aperçu CVE-2021-29447 est une vulnérabilité d'injection XML External Entity XXE affectant les versions 5.6 à 5.7 de WordPress corrigée dans la 5.7.1 lors de l'exécution de PHP 8.0+. La vulnérabilité réside dans la bibliothèque getID3 utilisée pour l'analyse des métadonnées...

CVE-2025-69080

Эксплойт LFI в теме Gecko CVE-2025-69080 Неаутентифицированная уязвимость локального включения файлов LFI в теме Gecko для WordPress = 1.9.8 ⚠️ Описание Данный эксплойт нацелен на уязвимость локального включения файлов высокой степени серьёзности CVSS 8.1 в теме JanStudio Gecko для WordPress...

CVE-2025-4334

CVE-2025-4334 - Simple User Registration --form Arguments : -u / --url → URL de base de WordPress ex. https://target.com/wordpress/ --form → URL complète du formulaire d'inscription ex. https://target.com/wpr/default-registration/ Exemple : python3 CVE-2025-4334.py -u https://example.com/wordpres...

CVE-2026-6271

CVE-2026-6271 — Scanner RCE pour l'extension WordPress Career Section Extension : Career Section career-section Identifiant CVE : CVE-2026-6271 Score CVSS : 9.8 Critique Vecteur CVSS : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type de vulnérabilité : Téléchargement de fichier arbitraire non...

CVE-2024-56067

CVE-2024-56067 WP SuperBackup = 2.3.3 — Отсутствие авторизации для неаутентифицированного скачивания файлов резервных копий Описание Плагин Super Backup & Clone - Migrate for WordPress для WordPress уязвим к несанкционированному доступу из-за отсутствия проверки прав доступа в функции во всех...

CVE-2026-8206-Lab

CVE-2026-8206 - Laboratoire de prise de contrôle de compte Kirki Laboratoire Docker local pour démontrer CVE-2026-8206 dans le plugin WordPress Kirki. Ce dépôt compare les versions réelles du plugin Kirki : vuln : Kirki 6.0.6 patched : Kirki 6.0.7 Le laboratoire est local uniquement et lie les...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Date de début : 30/07/2024 Vérifiez le diff de code entre la version vulnérable et la version corrigée : Référence de code 1 : https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php...

CVE-2024-34568

익스플로잇 제목: LetterPress = 1.2.1 - 쿠키 탈취 취약점 익스플로잇 저자: SANU P.L CVE: CVE-2024-34568 CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L 참고 자료: https://nvd.nist.gov/vuln/detail/CVE-2024-34568...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 Переходим на веб-страницу WordPress, где видим, что MFA включен через уязвимый плагин: Необходимо запустить PoC и предоставить учетные данные для входа: Автоматически откроется браузер через временный .html-фай...

wp2shell-lab

mini-wp-rest Компактная реализация небольшой части REST API WordPress без внешних зависимостей — достаточно, чтобы обслуживать публичную коллекцию записей и выполнять несколько подзапросов за одно обращение. Удобен для обучения тому, как маршрутизация WordPress, WPQuery и $wpdb сочетаются, не...

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Escalade de privilèges non authentifiée via 'createOrder' ⚠️ CVE-2025-14156 – Exploit d'escalade de privilèges non authentifiée Fox LMS WordPress 🛡️ Aperçu de la vulnérabilité Fox LMS – Plugin LMS WordPress v1.0.4.7 à v1.0.5.1 –...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Arguments obligatoires : -u, --url URL du site WordPress cible ex. http://127.0.0.1/wordpress -e, --email Email pour le nouveau compte administrateur Arguments facultatifs : -f, --fname Prénom défaut : Pwn -l, --lname Nom défaut : Admin -r, --role Rôle à...

CVE-2019-9978

CVE-2019-9978 – Preuve de concept PoC PoC fonctionnel pour la vulnérabilité CVE-2019-9978 , qui affecte le plugin Social Warfare = 3.5.2, permettant l'exécution de code à distance RCE sur WordPress. 📌 Description Cet exploit abuse du paramètre swpdebug=loadoptions pour forcer le chargement d'un...