CVE-2025-14736

CVE-2025-14736 DynamiApps 製 Frontend Admin - 認証なし権限昇格 作者: Hyun Chiya 脆弱性情報 フィールド| 値 ---|--- CVE ID| CVE-2025-14736 プラグイン| DynamiApps 製 Frontend Admin 影響を受けるバージョン| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST payload with 'role'='administrator'" C -- D"POST to...

CVE-2021-46362

CVE-2021-46362: Magnolia CMS における FreeMarker サーバーサイドテンプレートインジェクション Magnolia v6.2.3 以下の Registration フォームおよび Forgotten Password フォームにおけるサーバーサイドテンプレートインジェクション SSTI の脆弱性により、認証されていない攻撃者が fullname パラメータに入力した巧妙に細工されたペイロードを介して任意のコードを実行できる可能性があります。 協力: この脆弱性は Marian-Razvan Ilisanu 氏との共同研究により発見されました。...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 1つの隠しフィールド。1つの値の改変。Webサイト全体への完全なアクセス。 🧨 攻撃者は何ができるのか? 攻撃能力| 影響 ---|--- 🔑 ログインなしで管理者アカウントを作成| サイト完全乗っ取り Full Site Takeover 📦 WooCommerceの顧客データにアクセス| データ漏洩 Data Breach 💉 プラグイン/テーマファイル PHP を編集| リモートコード実行 Remote Code Execution 🕳️ 隠しバックドアを作成| 永続的アクセス Persistent Access 👥...

CVE-2025-2005

WordPress FEUP 任意ファイルアップロード脆弱性 CVE-2025-2005 このリポジトリは、WordPress プラグイン Front End Users バージョン 3.2.32 まで の Proof of Concept PoC エクスプロイトを提供します。このプラグインは、登録フォームにおける MIME/ファイルタイプの検証が欠如しているため、任意のファイルアップロードが可能です。これにより、認証されていない攻撃者が悪意のあるファイル 例: ウェブシェル をアップロードし、サーバー上でのリモートコード実行 RCE につながる可能性があります。 機能...

CVE-2025-6934

🛡️ CVE-2025-6934 - Opal Estate Pro における未認証の権限昇格 📝 説明 WordPress 用プラグイン Opal Estate Pro – Property Management and Submission （FullHouse - Real Estate Responsive WordPress Theme で使用）は、バージョン 1.7.5 までのすべてのバージョンにおいて 権限昇格 の脆弱性の影響を受けます。 CVE ID: CVE-2025-6934 CVSS スコア: 9.8（緊急） 公開日: 2025年6月30日 ⚙️ スクリプト情報 この...

CVE-2022-43097

CVE-2022-43097 CVE-2022-43097 の詳細情報 ソフトウェア: Phpgurukul User Registration & User Management System v3.0 ソフトウェアリンク: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ 説明: Phpgurukul User Registration & User Management System v3.0 には、登録フォームとログインページの first nam...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 공격자는 wpajaxnoprivwcfmajaxcontroller AJAX 액션에 특별히 조작된 요청을 전송하여 멤버십 등록 양식을 수정하고 등록 역할을 관리자로 설정합니다. 그런 다음 플러그인은 해당 요청을 처리하고 사용자가 관리자 역할로 등록할 수 있도록 멤버십 등록 양식을 수정합니다. 공격자는 수정된 멤버십 등록 양식을 제출하여 관리자 역할로 새로운 사용자로 등록할 수 있습니다...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 権限昇格 ║ ║ 未認証の管理者ロール割り当て（登録フォーム経由） PRİV8 ツールとエクスプロイトチャンネル: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431: Improper Privilege Management

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

PT-2026-89294

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

EUVD-2026-72066

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-77792: Improper Neutralization of Input During Web Page Generation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...