WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation

Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7. An unauthenticated attacker can exploit the AJAX endpoint flrblocksusersettingshandleajaxcallback to change the administrator's email address. Subsequently, the attacker...

CVE-2025-3604

🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Critical 公開日 : 2025年4月23日 最終更新日 : 2025年4月24日 ⚙️ スクリプト出力例 root@kitploit: Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to: [email protected] Exploit By Nxploited Khaledalenazi |...

CVE-2021-41074

CVE-2021-41074 Qloapps HotelCommerce 1.5.1 における CSRF HotelCommerce 1.5.1 には CSRF が存在します。これにより、誰でも管理者メールを変更できる可能性があります。 攻撃者が管理者に悪意を持って作成された HTML 文書をクリックさせると、管理者ユーザーのメールを変更される可能性があります。...

CVE-2025-4796

CVE-2025-4796 eventin そして、スピーカーのメールを自分が管理するメールに更新します。その後、攻撃者はWordPressのパスワードリセット機能を使用して管理者アカウントを乗っ取ることができます。 必要条件: Python 3.8 以上 requests requestsのインストール: pip install requests 使用方法 スクリプトを実行し、プロンプトに従って必要な値を入力してください： python3 CVE-2025-4796.py 出力例 + SSL検証警告を無効化 + WordPressにログイン中。 + ログイン成功。 +...

CVE-2024-13513.py

사용법 기본 사용법 bash python3 exploit.py -l targets.txt -e [email protected] 고급 사용법 bash python3 exploit.py -l targets.txt -e [email protected] -t 100 -o /path/to/results 매개변수 설명 매개변수| 설명| 필수| 기본값 ---|---|---|--- -l, --list| 대상 URL이 포함된 파일 경로| ✅ 예| - -e, --email| 비밀번호 재설정을 위한 이메일 주소| ✅ 예| - -...

CVE-2025-4796

CVE-2025-4796 Eventin メールアドレスが攻撃者制御のアドレスに変更されると、標準のWordPressパスワードリセットフローを使用してアカウントを乗っ取ることができます。 🧰 スクリプト PoC Filename: CVE-2025-4796.py このスクリプトは以下の手順を自動化します： 1. 提供された認証情報を使用して対象のWordPressサイトにログインします。 2. 必要なX-WP-Nonceを抽出します。 3. PUTリクエストを/wp-json/eventin/v2/speakers/に送信してスピーカーのメールを更新します。 4...

CVE-2026-54176

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-54176

backpack/crud (Laravel Backpack CRUD) versions 6.0.0 through 6.8.14 and 7.0.38 allow an authenticated user to change the account-recovery email without a current-password check. The vulnerable method is MyAccountController::postAccountInfoForm, which passes $request->validated() directly to $u...

CVE-2026-54176: Improper Authentication

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

EUVD-2026-72062

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

PT-2026-86482

🚨 CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and...

CVE-2026-79995

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

EUVD-2026-67574

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability

Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...