CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / エクスプロイトスクリプト: CVE-2026-2631.py 著者: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub 連絡先: Telegram: @Kxploit 🧬 脆弱性の概要 プラグイン: Datalogics Ecommerce Delivery – Datalogics WordPress 影響を受けるバージョン: 2.6.60（2.6.60 未満） 脆弱性タイプ: 未認証の権限昇格 CVE:...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress プラグイン大量悪用ツール CVE-2026-8206 用の大量悪用ツール – Kirki WordPress プラグイン（バージョン ≤ 6.0.6）の重大な脆弱性を悪用し、認証されていない攻撃者がパスワードリセットリンクを乗っ取って、管理者を含む任意のユーザーアカウントを乗っ取ることができます。 脆弱性の概要 Kirki プラグインは、認証不要の REST...

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

WPAdverts <= 2.3.2 - Information Disclosure

WPAdverts – Classifieds Plugin for WordPress = 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication. id:...

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...

CVE-2022-47615

CVE-2022-47615 LearnPress プラグイン 4.2.0 - 認証なし LFI 脆弱性の説明 説明 このプラグインは、lp/v1/courses/archive-course REST エンドポイントで様々なパラメータを適切に検証せずに include 文で使用しているため、LFI 問題が発生する可能性があります。 使用方法 root@kitploit: $ python3 exploit.py -u http://wordpress.lan -f ../../../etc/passwd root:x:0:0:root:/root:/bin/bash...

cve-2022-1388-iveresk-command-shell

CVE-2022-1388 by 1vere$k コマンドシェル付き 複数のF5製品に影響を与えるCVE-2022-1388の改良版POC。 これは、CVE-2022-1388に対するHorizon3のProof of Conceptの改良版です: https://github.com/horizon3ai/CVE-2022-1388 また、PsychoSecの作業（https://github.com/PsychoSec2/CVE-2022-1388-POC）をリファクタリングして完全に作り直したものです。...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - 未授权的任意选项更新 描述 该插件在通过 REST 端点更新选项时缺乏授权和 CSRF 检查，并且未确保要更新的选项属于该插件。因此，未认证的攻击者可以更改任意博客选项，例如 userscanregister 和 defaultrole，从而允许他们创建新的管理员账户并接管博客。 示例：启用管理员与注册 root@kitploit: $ python3 CVE-2022-0952.py -u http://192.168.1.131:5555 The plugin version is below...

amasty-chekout-POC-rce

CVE-2026-53787 - Amasty Order Attributes 未认证文件上传 描述 CVE-2026-53787 是 Amasty Order Attributes 扩展中一个严重的未认证任意文件上传漏洞，影响 Magento 2 早于 4.0.0 的版本。该漏洞允许攻击者将任意类型或名称的文件上传到商店的媒体目录，而无需身份验证、会话验证或购物车上下文。 影响 该攻击无需凭据，可通过网络执行。该漏洞的 CVSS 评分为 9.8（严重）。成功利用可能导致： 如果媒体目录允许执行 PHP，则可实现远程代码执行（RCE），使攻击者完全控制服务器 利用受信任域名托管恶意软件...

CVE-2026-86812

WPCafe WordPress plugin versions 3.0.10 through 3.0.17 are affected by an authorization flaw in its food-orders REST API endpoints. The root cause is that permission callbacks return an incorrect type on failure , which bypasses access checks and allows unauthenticated users to disclose guest ord...

0-click-RCE-Exploit-for-CVE-2024-9932

CVE-2024-9932 / 0-Click RCE 漏洞利用 作者：Joshua Provoste https://x.com/JoshuaProvoste/status/1858329238153072668 此仓库包含针对 CVE-2024-9932 的概念验证利用代码，该漏洞是 Wux Blog Editor WordPress 插件中的一个未经身份验证的任意文件上传漏洞，可导致远程命令执行（RCE）。 脚本功能 该脚本利用一个易受攻击的 REST 端点，无需身份验证即可上传远程 PHP 负载。上传后，它会重构最终文件位置、检测目标操作系统，并提供用于命令执行的交互式远程...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution 访问控制失效 在 Eventin WordPress 插件（拥有 10,000+ 活跃安装）中存在未经身份验证的 PII 泄露 和 订单伪造 。一个公开的 REST 端点向任何访问者分发 wprest nonce，三个下游权限回调将该 nonce 视为身份验证的替代品——导致所有客户订单端点的授权机制失效。 完整技术分析： https://lorenzofradeani.com/en/blog/cve-2026-40776 Patchstack 公告：...

CVE-2022-1388-POC

CVE-2022-1388 Poc por PsychoSec POC mejorado para CVE-2022-1388 que afecta a múltiples productos F5. Esta es una versión mejorada de la Prueba de Concepto de Horizon3 para CVE-2022-1388: https://github.com/horizon3ai/CVE-2022-1388 Esta versión contiene múltiples mejoras, así como un shell...

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint vulnerability

Unauthenticated Authentication Bypass via Default 'token' Fallback in REST Migration Endpoint vulnerability discovered by Samuele Santonicola in WordPress Plugin Next-Cart Store to WooCommerce Migration versions = 3.9.8...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration WordPress plugin (versions ≤ 3.9.8) is vulnerable to unauthenticated authentication bypass via the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration is registered with permission_callback set to __return_true and relies on...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...