CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - Escalação de Privilégios na REST API para RCE PoC Completo Versão afetada: 5.0.0 a 7.2.0 Requisito de usuário: Usuário assinante Subscriber Método: Escalação de Privilégios para Administrador e execução de RCE via REST API Endpoint: endpoint /v1/members/me. Como...

CVE-2023-2833

Gerador de Exploit em Massa CVE-2023-2833 por Alucard0x1 Este repositório contém um exploit para o CVE-2023-2833, uma vulnerabilidade de escalada de privilégio no plugin ReviewX para WordPress versões até e incluindo 1.6.13. Descrição O plugin ReviewX é vulnerável a escalada de privilégio,...

PT-2026-92016

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudy ms stm set discard transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient k...

PT-2026-88896

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add user in waiting list function registered on the wp ajax yith wcwtl add user action being missing both a capability check and a nonce...

CVE-2026-19453 JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

CVE-2026-19453 JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

CVE-2026-19453

The JetBackup WordPress plugin versions before 3.1.23.5 is vulnerable to a privilege escalation flaw. The plugin fails to verify the roles or capabilities of an account preserved during a restore or migration process. Consequently, a user with subscriber-level privileges can gain administrator ac...

CVE-2026-5617 Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handlereturntoadmin function trusting a client-controlled cookie oclauporiginaladmin to determine which user to authenticate as, without any server-side...