CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — 인증되지 않은 RCE Allowlist 없는 calluserfunc를 통한 취약점 요약 Avada Fusion Builder 테마 — 900,000+ 활성 설치 수를 자랑하는 인기 WordPress 프리미엄 테마 — 의 Avada Builder Fusion Builder 버전 = 3.15.2 에서 인증 없이 원격 코드 실행RCE 이 가능한 취약점입니다. 공격은 wpajaxnoprivfusiongetwidgetmarkup AJAX 핸들러를 악용합니다. 이 핸들...

CVE-2026-14894

CVE-2026-14894 — Super Forms ≤ 6.3.313 개요 인증되지 않은 임의 파일 업로드 → 원격 코드 실행 이 WordPress 플러그인 Super Forms 버전 ≤ 6.3.313 에 존재합니다. 취약점은 AJAX 핸들러 supersubmitform에 있으며, 이 핸들러는 datauristring 필드를 통해 파일 업로드를 처리할 때 디스크에 쓰기 전에 파일 확장자나 MIME 타입을 검증하지 않습니다. 인증되지 않은 공격자는 PHP 웹쉘을 업로드하여 대상 서버에서 완전한 원격 코드 실행을 달성할 수 있습니...

EUVD-2026-68329

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce 認証なしファイルアップロード RCE Nonce リーク → certificatecrtpath アップロード → コード実行 概要 CVE-2026-3891 は、Pix for WooCommerce WordPress プラグイン（linknacional 製）バージョン ≤ 1.5.0 における、CVSS 9.8 の重大度を持つ認証なし の任意ファイルアップロード脆弱性です。 lknpixforwoocommercec6savesettings AJAX ハンドラーには、以下の問題があります： 1...

PT-2026-83848

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.2 Description An unauthenticated remote code execution issue exists in the ProfilePress WordPress plugin. Unauthenticated attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc MajorDomo（Major Domestic Module）の管理パネルのPHPコンソール機能を介した、認証なしのリモートコード実行（RCE）を悪用する概念実証（PoC）です。 脆弱性 MajorDoMoの管理パネルは、/admin.php を介してPHP評価コンソールを公開しています。panel.class.php の認証リダイレクト後に exit が欠落しているため、AJAXハンドラ incpanelajax.php が無条件にインクルードされ、その eval は認証されていない任意のHTTPリクエストから到達可能になりま...

CVE-2026-15980

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

PT-2026-83520

Name of the Vulnerable Software and Affected Versions MyHome Core versions prior to 4.4.6 Description An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the send link AJAX handler and improper token validation within the activate...

EUVD-2026-67406

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

Winter: CSRF through AJAX handler names reachable as backend page actions

Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...

GHSA-FM29-4MQ3-PHG6 Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin (all versions ≤ 1.2.6 ) contains an unauthenticated authorization bypass in the admin_user_create_cus AJAX handler. The handler passes the attacker-controlled truebooker_wp_user_id parameter directly to wp_update_user with...

CVE-2026-18315 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

EUVD-2026-62630

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication o...

PT-2026-78571

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin user create cus AJAX handler lacking any authenticatio...