CVE-2026-84741

The Events Calendar WordPress plugin (versions 4.5 - 6.17.4 ) is vulnerable to an unauthenticated information disclosure. The application fails to verify the post status of linked records before embedding their details into a public REST API response. This oversight allows unauthenticated users t...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

EUVD-2026-85038

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.9.1-8.9.4 is vulnerable to a paid order and payment record forgery vulnerability. The root cause is a failure to check user capabilities when creating orders via the plugin's REST API . This allo...

EUVD-2026-85033

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

CVE-2026-86785

The Social Commerce for WooCommerce WordPress plugin, version 2.5.4 and below , is vulnerable to an unauthenticated privilege escalation. The root cause is a lack of authorization checks on specific REST API endpoints , which allows attackers to modify the plugin's configuration and product synch...

CVE-2026-86785 Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

EUVD-2026-85019

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

CVE-2018-7691

CVE-2018-7691 SSC REST APIには、安全でないダイレクトオブジェクト参照（IDOR）の脆弱性が含まれており、認証されたユーザーがPOSTメソッドを使用してローカルユーザーおよびLDAPユーザーの任意の詳細にアクセスし、GETメソッドを使用して他のユーザーのFortifyプロジェクトの任意の詳細にアクセスできるようになります。 Exploit-DBでの公開: https://www.exploit-db.com/exploits/45990 PacketStormでの公開:...

CVE-2025-12721

g-FFL Cockpit 'returntrue' で登録されているため、未認証の訪問者であれば誰でも完全にアクセスできます。...

CVE-2024-10924

CVE-2024-10924 - Really Simple Security における認証バイパス 概要 このプロジェクトは、WordPressプラグイン「Really Simple Security」における重大な認証バイパス脆弱性であるCVE-2024-10924の悪用と緩和策を実証するものです。 ステップ1: 環境構築 脆弱なWordPress環境を起動します: cd wordpress-really-simple-security-authn-bypass-vulnerable-application docker-compose up -d...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPressユーザー列挙（REST経由） セットアップ root@kitploit: git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 使用方法 root@kitploit: .\Enumerate-WordPressOrgMembersREST.ps1 代替ルート1（WAFバイパス用）...

CVE-2022-1598

CVE-2022-1598 WPQA IDは数値で、ブルートフォースが可能です！ Nucleiテンプレート: CVE-2022-1598.yaml ビデオPOC: https://www.youtube.com/watch?v=MbhiQKWvivQ...

CVE-2025-1562

CVE-2025-1562 root@kitploit: POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124...

CVE-2026-25197

CVE-2026-25197: ユーザー制御キーによる認証バイパス IDOR 勧告 フィールド| 値 ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher| Michael Groberman — Gr0m Published|...

wp2shell-vulnerability-scanner

WP2Shell スキャナー WordPress インストールをスキャンして wp2shell 脆弱性チェーンをチェックする、読み取り専用で非破壊的なセキュリティ監査ツールです。 概要 WP2Shell Scanner は、ディレクトリツリーを再帰的に検索して WordPress インストールを探し、各サイトが wp2shell 脆弱性 CVE-2026-63030 + CVE-2026-60137 に対して脆弱なコアバージョンを実行しているかどうかをチェックする bash ユーティリティです。 このツールは、システム管理者やセキュリティチームが緊急パッチが必要な WordPress...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Plugin Acyber Wordpress !WARNING CVE-2026-60137 および CVE-2026-63030 wp2shell に対する緊急一時緩和策 wp2shell 脆弱性チェーンに対する緊急一時リスク軽減策 🇬🇧 英語の説明 この軽量 WordPress プラグインは、重大な wp2shell エクスプロイトチェーン（CVE-2026-60137 および CVE-2026-63030 ）に対する一時的な仮想パッチ（緩和策）として機能します。 このエクスプロイトチェーンにより、標準構成の WordPress インストール（バージョン...