WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

CVE-2026-11351: Exposure of Sensitive Information to an Unauthorized Actor

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...

CVE-2026-13425: Improper Neutralization of Input During Web Page Generation

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

ArcGIS Exposed REST API documentation Detection

ArcGIS REST API documentation was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ArcGIS REST API documentation was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ArcGIS Exposed REST API...

Couchbase Buckets Unauthenticated REST API - Detect

Couchbase Buckets REST API without authentication was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Couchbase Buckets REST API without authentication was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Apache Kylin - Exposed Configuration File Detection

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without...

F5 BIG-IP iControl REST Panel - Detect

F5 BIG-IP iControl REST API discovered and may be vulnerable to an authentication bypass not tested. !/usr/bin/env python3 -- coding: utf-8 -- """F5 BIG-IP iControl REST API discovered and may be vulnerable to an authentication bypass not tested.""" from kittysploit import from...

Burp Rest API Server Running Detection

Detects Burp Rest API Server Running. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Burp Rest API Server Running.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Burp Rest API Server Running Detection',...

Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal Detection

Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Wowza Streaming Engine 4.""" import re from kittysploit import from...

Jira - Incorrect Authorization Detection

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. !/usr/bin/env...

WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference Detection

WordPress acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wpoptions table such as the login and pass values. !/usr/bin/env python3 -- coding: utf-8 ...

WebSwing REST API Version - Detection

WebSwing REST API version via the /rest/version endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """WebSwing REST API version via the /rest/version endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebSwin...

WordPress REST API User Enumeration Detection

The REST API exposed user data for all users who had authored a post of a public post type. WordPress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API. !/usr/bin/env python3 -- coding: utf-8 -- """The REST API exposed user data for all users...

Spark Lighter Detection

Detects a Spark Lighter server, a REST API for Apache Spark on K8S or YARN. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Spark Lighter server, a REST API for Apache Spark on K8S or YARN.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Unauthenticated Spark REST API Detection

The Spark product's REST API interface allows access to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """The Spark product's REST API interface allows access to unauthenticated users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Phoenix Contact CHARX SEC-3XXX AC Charging Controller REST API - Detect

Phoenix Contact CHARX SEC-3XXX AC Charging Controller REST API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Phoenix Contact CHARX SEC-3XXX AC Charging Controller REST API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Redmine Issues - Exposure Detection

Redmine instance exposed issues via the REST API without authentication. This could have leaked sensitive project information, issue details, and user data. !/usr/bin/env python3 -- coding: utf-8 -- """Redmine instance exposed issues via the REST API without authentication.""" from kittysploit...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication Detection

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

ZenML ZenML Server - Improper Authentication Detection

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. !/usr/bin/env python3 --...

XWiki Platform - Unauthorized Document History Access Detection

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...