CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - 未认证的 SQL 注入 该插件在将 REST 路由中的参数用于 SQL 语句之前，未对其进行清理和转义，从而允许未经认证的用户执行 SQL 注入攻击。 设置脚本： 1. git clone https://github.com/kryptonproject/CVE-2024-5522-PoC 2. cd CVE-2024-5522-PoC 3. pip3 install r requirements.txt 4. python3 exploit.py 查找目标： 1. 使用此...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

Essential Blocks < 6.4.0 - Information Disclosure

Gutenberg Essential Blocks WordPress plugin 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data. id: CVE-2026-13153 info: name: Essential Blocks 6.4.0 -...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

EUVD-2026-92967

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

PT-2026-106337

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

wp2shell-lab

wp2shell-lab 针对 CVE-2026-63030 + CVE-2026-60137 的教育性 PoC 与实验环境：WordPress 核心中通过 REST 批处理路由混淆实现的不需要认证的 SQL 注入。 由 Adam Kues（Searchlight Cyber / Assetnote）发现。已在 WordPress 6.9.5 / 7.0.2 中修复。 快速开始 启动漏洞实验环境 cd docker && ./setup.sh cd .. 检测 python3 -m exploit check http://localhost:8888 python3 -m exploi...

wp2shell-poc

这究竟是如何工作的 本 PoC 与公开的 wp2shell 漏洞利用有何不同 所有 PoC 都利用了相同的两个缺陷 - REST 批量路由混淆（CVE-2026-63030）和 authornotin SQL 注入（CVE-2026-60137）- 并采用相同的双重嵌套批次结构。 它们之间的区别在于所选择的远程代码执行（RCE）路径 、环境前置条件 ， 以及安全默认设置 。本文档具体说明了本仓库中的实现在这一格局中所处的位置。 简要概述 1. 在存在持久化对象缓存时依然有效。 公开的基于 UNION 的 PoC 使用 已填充基集的注入形式：这一系列所共享的全链实现在那里会出现假阴性，...

CVE-2026-14281

LANGZ Scanner + Exploit 针对 CVE-2026-14281 的批量扫描器 + 单目标利用工具 —— WordPress Automation Web Platform WAWP 插件 没有权限检查。处理程序将攻击者可控的 wawpcustomfields 复制到 updateusermeta —— 没有允许列表。攻击者设置： "wawpcustomfields": "wpcapabilities": "administrator": true, "wpuserlevel": "10" 结果：新账户获得 administrator 角色。 附加：OTP 绕过 OTP...

CVE-2026-92548

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

EUVD-2026-90477

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

CVE-2026-92548

The WP Popular Posts plugin for WordPress (versions up to and including 7.4.2 ) is vulnerable to Sensitive Information Exposure . Unauthenticated attackers can extract sensitive edit-context fields—such as raw title, raw content body, password, meta, status, and guid—from non-public post objects ...

CVE-2026-92548 WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

CVE-2026-92548 WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

EUVD-2026-90455

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...

PT-2026-103672

Name of the Vulnerable Software and Affected Versions WP Popular Posts versions prior to 7.4.3 Description An issue exists where unauthenticated attackers can extract sensitive information from non-public post objects, such as wp block synced patterns, which are typically protected by WordPress...

CVE-2026-92548: Exposure of Sensitive Information to an Unauthorized Actor

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

CVE-2026-89300

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-89300

The WP Verify API WordPress plugin, in versions through 1.0.0 , contains a vulnerability where one of its REST routes lacks sufficient authorisation checks . This flaw allows unauthenticated users to insert arbitrary data into the plugin's database table and trigger the delivery of templated veri...