wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application Esta es una aplicación vulnerable para probar el exploit de la omisión de autenticación de Really Simple Security 9.1.2 CVE-2024-10924. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Úsala bajo tu...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Tot...

Python-exploit-CVE-2020-25213

Descripción El plugin File Manager wp-file-manager anterior a la versión 6.9 para WordPress permite a atacantes remotos cargar y ejecutar código PHP arbitrario porque renombra un archivo de conector elFinder de ejemplo inseguro para que tenga la extensión .php. Esto, por ejemplo, permite a los...

CVE-2021-29447-PoC

CVE-2021-29447 Prueba de Concepto root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Escrito por Isa Ebrahim - 0xRar en enero de 2023 ═══════════════════════════════════════════════════════════════════════════ Título: Problema de análisis XML en la librería multimedia de WordPress que...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-12757

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

wp2shell-scanner

wp2shell-scanner Detection and validation tooling for WordPress core exposure to wp2shell CVE-2026-63030 / CVE-2026-60137. Modes are selected with a flag, and the target is positional. --scan fingerprints the core version and confirms the REST /batch/v1 route is reachable without sending an explo...

CVE-2023-5561-PoC

CVE-2023-5561-PoC WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack Source:...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2022-0739

CVE-2022-0739 Python PoC Exploit para CVE-2022-0739 Características Búsqueda de metadatos de base de datos Volcado de credenciales de usuario de Wordpress Inyección arbitraria de consultas ciegas 💉 Uso root@kitploit: usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help messag...

CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronization SQL Injection Exploit Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 wp2shell vulnerability. Vulnerability Information CVE : CVE-2026-63030 wp2shell Companion CVE : CVE-2026-60137 Type : Pre-Auth...

CVE-2024-7627-PoC

CVE-2024-7627-PoC Background This Proof-of-Concept PoC script is for WordPress plugin Bit File Manager version 6.0 - 6.5.5 Unauthenticated Remote Code Execution via Race Condition CVE-2024-7627 vulnerability. Information Description: The Bit File Manager plugin for WordPress is vulnerable to Remo...

CVE-2023-2986

Prueba de Concepto Original para CVE-2023-2986 Prueba de Concepto para la vulnerabilidad CVE-2023-2986 en el plugin 'Abandoned Cart Lite for WooCommerce' de WordPress Detalles Relacionados Enlace NVD : https://nvd.nist.gov/vuln/detail/CVE-2023-2986 Fuente del Plugin :...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 WordPress REST API Batch SQL Injection to RCE Full discovery and exploitation tool for WordPress REST API Batch endpoint vulnerability. This tool exploits a critical SQL injection vulnerability in the WordPress REST API /wp-json/batch/v1 endpoint, allowi...

cve-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...