wp2shell-poc

wp2shell-poc Preuve de concept indépendante pour l'injection SQL par confusion de route dans le lot REST non authentifié de WordPress, associée à l'avis wp2shell de Searchlight Cyber. Ce dépôt n'est pas le vérificateur officiel de Searchlight Cyber. check confirme le chemin SQLi, read démontre la...

CVE-2026-80099

CVE-2026-80099 PoC Contournement d'authentification non authentifié et exploit RCE ciblant les plugins WordPress Newfold qui intègrent wp-module-data. Aperçu Cet outil exploite une faille de validation de jeton Bearer dans le module Newfold wp-module-data. Lorsqu'un site WordPress utilisant un...

CVE-2026-63030

CVE-2026-63030 سلسلة استغلال كاملة PoC لـ ارتباك توجيه الدُفعات batch routing confusion + حقن SQL في REST API لووردبريس، تؤدي إلى إنشاء مسؤول غير مصرح به → تنفيذ تعليمات برمجية عن بُعد RCE. للاستخدام فقط في اختبار الأمان المصرح به، وإعادة إنتاج الثغرات والبحث. يُمنع الاستخدام ضد أهداف غير مصرح به...

wp2shell-lab

mini-wp-rest إعادة تنفيذ مدمجة وخالية من التبعيات لجزء صغير من واجهة REST API الخاصة بـ WordPress — تكفي فقط لخدمة مجموعة منشورات عامة وتشغيل عدة طلبات فرعية في رحلة ذهاب وإياب واحدة. مفيدة لتعليم كيفية عمل توجيه WordPress و WPQuery و $wpdb معًا دون الحاجة إلى تحميل كل النواة. النقاط النهائية...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — إثبات مفهوم PoC لثغرة حقن SQL الأعمى القائم على الوقت في WordPress REST API → تنفيذ أكواد عن بُعد RCE الوصف pocwptot.py هو إثبات مفهوم PoC لاستغلال ثغرة حقن SQL الأعمى القائم على الوقت time‑based blind SQL injection في نقطة نهاية الدُفعات batch الخاصة بـ WordPress REST API، وتنفيذ سلسل...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin, versions 2.0.0 through 2.0.6 , contains a vulnerability where it fails to enforce site-wide access restrictions on the WordPress REST API . This flaw allows unauthenticated users to read the content of published posts and pages that were specifical...

EUVD-2026-91212

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90952: Missing Authorization

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

PT-2026-104111

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-100514

The WordPress REST API Log plugin affects versions

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin REST API Log versions = 1.7.2...

POC-ELEMENTOR-CSRF

POC-ELEMENTOR-CSRF — Laboratorio pedagógico del bypass del non...

CVE-2026-96524

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

EUVD-2026-87536

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524

The MCP Server for WordPress plugin (versions before 1.8.2 ) contains a CSRF vulnerability due to insufficient verification of the WordPress REST API nonce for cookie-authenticated requests. When an attacker influences specific conditions, they can trick a logged-in administrator into visiting a ...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...