wp2shell-poc

Cómo puede funcionar esto En qué se diferencia este PoC de los exploits públicos de wp2shell Todos los PoC weaponizan los mismos dos bugs: la confusión de rutas del batch REST CVE-2026-63030 y la inyección SQL authornotin CVE-2026-60137, con la misma forma de batch doblemente anidado. Lo que...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

wp2shell-lab

wp2shell-lab PoC educativo y laboratorio para CVE-2026-63030 + CVE-2026-60137 : inyección SQL sin autenticación en el núcleo de WordPress mediante confusión de rutas batch REST. Descubierto por Adam Kues Searchlight Cyber / Assetnote. Corregido en WordPress 6.9.5 / 7.0.2. Inicio rápido bring up t...

CVE-2026-89300

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-89300

The WP Verify API WordPress plugin, in versions through 1.0.0 , contains a vulnerability where one of its REST routes lacks sufficient authorisation checks . This flaw allows unauthenticated users to insert arbitrary data into the plugin's database table and trigger the delivery of templated veri...

Essential Blocks < 6.4.0 - Information Disclosure

Gutenberg Essential Blocks WordPress plugin 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data. id: CVE-2026-13153 info: name: Essential Blocks 6.4.0 -...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'cart_items[][product_name]' parameter. Because the ch...

EUVD-2026-86594

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86548

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

EUVD-2026-85044

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608

The WP Recipe Maker WordPress plugin (versions 9.8.0-10.8.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because one of the plugin's REST routes lacks proper authorization checks and fails to bound the data it stores. This allows unauthenticated attackers to wri...