CVE-2024-1512

CVE-2024-1512 Prueba de Concepto Resumen de la Vulnerabilidad CVE-2024-1512 expone una vulnerabilidad crítica en el plugin MasterStudy LMS de WordPress, específicamente en la implementación de la ruta REST /lms/stm-lms/order/items. El problema surge por la falta de escape adecuado del parámetro...

CVE-2021-29447

CVE-2021-29447 POC para explotar la inyección XXE autenticada en WordPress 5.6-5.7 PHP 8+. Más información sobre este CVE aquí Ejemplo Ejemplo de uso contra la máquina MetaTwo de HackTheBox, que aloja un sitio web de WordPress con la biblioteca de medios vulnerable a la inyección XXE. python lfi....

CVE-2019-9978

CVE-2019-9978 Vulnerabilidad RCE en el plugin Social Warfare de WordPress 3.5.3 🐞 Simulación mínima del plugin vulnerable y su explotación 🥰 Instalación del plugin vulnerable Instalar dependencias: docker-compose build Iniciar los contenedores del servidor vulnerable y atacante docker-compose up ...

wp2shell-lab

wp2shell laboratorio y detector + PoC de RCE sin autenticación Un laboratorio autónomo, detector no destructivo y prueba de concepto completa de RCE sin autenticación para wp2shell — la cadena de vulnerabilidades de pre-autenticación en el núcleo de WordPress: CVE| Componente| Clase| CVSS...

wp2shell

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion, CVSS 7.5 + CVE-2026-60137 SQL Injection, CVSS 9.1 A pre-authentication remote code execution chain in WordPress Core that requires no plugins, no special configuration, and works on default installs. Affected Versions...

CVE-2021-24155.rb

WordPress-Backup-RCE This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard versions prior to 1.6.0. This is due to an incorrect check of the uploaded file extension whi...

WordPress ACPT (Premium) plugin <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.66...

CVE-2023-32243

CVE-2023-32243. Essential Addons for Elementor 5.4.0-5.7.1 - Escalada de Privilegios No Autenticada Información El plugin no valida la clave de restablecimiento de contraseña, lo que podría permitir a atacantes no autenticados restablecer la contraseña de cualquier cuenta a lo que deseen,...

WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2024-25600

TG Únete a nosotros https://t.me/WanLiChangChengWanLiChang Únete a nosotros para recibir periódicamente varios EXP POC de vulnerabilidades. Exploit CVE-2024-25600 El plugin de WordPress Bricks Builder tiene una vulnerabilidad RCE CVE-2024-25600. Script de explotación de la vulnerabilidad RCE...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Exploit de subida arbitraria de archivos CVE-2024-56264 Resumen Este repositorio contiene un exploit para CVE-2024-56264 , que es una vulnerabilidad de subida arbitraria de archivos encontrada en el plugin de WordPress ACF City Selector versiones =...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary Field| Value ---|--- CVE| CVE-2026-12277 Plugin| Frontend File Manager Plugin nmedia-user-file-uploader Affected| = 23.6 Type| Unauthenticated Arbitrary File Deletion CVSS| 8.7 HI...

CVE-2026-97303 WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...

CVE-2026-97303

The Scratch & Win – Giveaways and Contests WordPress plugin (versions

CVE-2026-97303 WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

EUVD-2026-92586

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...