209 matches found
CVE-2026-13157
CVE-2026-13157 Theme Demo Import false를 명시적으로 비활성화합니다. 기본 사이트 관리자 또는 WordPress 멀티사이트 아키텍처에서 슈퍼 관리자가 아닌 사이트 관리자와 같이 가져오기import 권한을 보유한 인증된 사용자는 파일 제한 시행을 우회하여 공개된 wp-content/uploads/ 디렉터리에 임의의 실행 가능한 PHP 스크립트를 직접 업로드할 수 있으며, 이를 통해 지속적인 원격 코드 실행RCE 및 완전한 서버 장악을 달성할 수 있습니다. 📌 핵심 요약 매개변수| 기술 사양 ---|-...
CVE-2026-32584
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4....
CVE-2026-32584 WordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4....
CVE-2026-32584 WordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4....
EUVD-2026-91658
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4....
cve-2026-39440-funnelforms-fix
CVE-2026-39440 FunnelForms 수정 취약한 FunnelForms Pro ≤ 3.8.1 의 Demo Import 핸들러를 차단하여 원격 코드 실행CVE-2026-39440, CVSS 9.9 위험을 완화하는 드롭인 WordPress 플러그인입니다. 취약점 정보 필드| 값 ---|--- CVE ID| CVE-2026-39440 CVSS 점수| 9.9 치명적 영향 범위| FunnelForms Pro ≤ 3.8.1 권한 수준| 낮음 구독자 수준 유형| 코드 주입 → 원격 코드 포함 → RCE 패치 여부| 공식 공급업체...
CVE-2024-9698
CVE-2024-9698 Crafthemes Demo Import " 🔥 예제 출력 + Target is vulnerable, proceeding with exploit... + Logged in successfully. + Extracted nonce: abc123xyz + Shell uploaded succ...
CVE-2026-88845
The MasterStudy LMS WordPress Plugin versions before 3.7.50 is vulnerable to an unauthorized action due to a lack of capability or nonce checks on an administrative maintenance action. This flaw allows any authenticated user , such as a subscriber, to trigger the action and create published conte...
CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...
CVE-2026-26212
The Rara One Click Demo Import WordPress plugin before version 1.3.5 contains an arbitrary file upload vulnerability. Authenticated attackers with Administrator privileges can pass a false value to wp_handle_upload() , disabling WordPress core's file type validation across all three file paramete...
EUVD-2026-75028
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...
CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...
PT-2026-89057
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp handle upload that disables WordPress core's file type...
WordPress Rara One Click Demo Import plugin <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload vulnerability
Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Rinesa Krasniqi in WordPress Plugin Rara One Click Demo Import versions = 1.3.4...
CVE-2026-26212: Unrestricted Upload of File with Dangerous Type
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...
WordPress Solace Extra plugin <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability
Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Solace Extra versions = 1.6.0...
CVE-2026-18316
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
