CVE-2026-12956

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

EUVD-2026-74567

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

CVE-2026-12956

The WP Event Solution (Eventin) WordPress plugin (versions ≤ 4.1.22 ) is affected by a Missing Authorization vulnerability in the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function relies solely on a wp_rest nonce that is leaked to every visitor via the etn-pub...

CVE-2026-12956 Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-76801 FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

WP-Bricks-Exploit-CVE-2024-25600

BricksRCE Exploiter（ブリックスRCEエクスプロイター） CVE-2024-25600 — WordPress Bricks Builder の非認証リモートコード実行脆弱性 CVE-2024-25600 のための認可されたセキュリティ評価ツール 作成者: Sudeepa Wanigarathna · ツール: BricksRCE Exploiter v1.0 メインスクリプト: cve-2024-25600.py !IMPORTANT 認可された使用のみ。...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST 批处理路由混淆 SQLi PoC 一个独立的 PoC，用于演示通过 WordPress REST 批处理端点（/wp-json/batch/v1）可触发的未认证盲 SQL 注入。它基于已公开的漏洞机制独立实现。 官方公告 ：WordPress 安全发布 | CVE-2026-63030 作者： J4ck3LSyN 致谢： CFSD 、 NFK 和 C4b1NKr3W 注意： 出于显而易见的法律原因，我没有随附相关的 武器化 r00t.py 持久化植入模块。 如需获取，可通过 x 私信我 !WARNING...

wp2shell-scanner

wp2shell-scanner 检测和验证工具，用于 WordPress 核心对 wp2shell（CVE-2026-63030 / CVE-2026-60137）的暴露情况。通过标志选择模式，目标为位置参数。--scan 对核心版本进行指纹识别，并确认 REST /batch/v1 路由可达，且不发送漏洞利用载荷；--check/--read/--shell/--rce/--root-prereq 模式是供授权实验室使用的验证 PoC。 wp2shell.py 是一个仅使用标准库的单一脚本——无外部依赖。每次调用在运行前都会向 stderr 打印 ZephrSec 横幅（它不写入...

CVE-2026-86417

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

PT-2026-86767

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability discovered by Applied Cybernetics in WordPress Plugin LearnDash LMS versions 4.25.0-5.1.6...

CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

CVE-2026-83543

Greenshift WordPress plugin versions before 13.2.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the get-csv-to-json REST endpoint . The plugin fails to validate a user-supplied URL before issuing a server-side request, allowing users with contributor-level access or above to forc...

CVE-2026-80438

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

EUVD-2026-70907

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

CVE-2026-16983

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...