CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 إثبات المفهوم PoC الوصف يحتوي هذا المستودع على إكسبلويت إثبات المفهوم PoC لـ CVE-2023-6972. الثغرة تسمح بحذف ملفات عشوائي غير مصدق عليه AFD في إضافة Wordpress Backup Migration ملاحظة: تحليل تقني شامل، دراسة حالة كاملة، وتحليل السبب الجذري لهذا الإكسبلويت متاحة على الرابط...

wordpress-true-ranker-cve-2021-39312

إضافة ووردبريس The True Ranker 2.2.2 - قراءة ملفات تعسفية نموذج إثبات مفهوم مكتوب بلغة بايثون لـ CVE-2021-39312 ، يؤثر على إضافة ووردبريس The True Ranker seo-local-rank بالإصدارات ≤ 2.2.2. تفاصيل الثغرة CVE: CVE-2021-39312 النوع: قراءة ملفات تعسفية الإضافة المتأثرة: The True Ranker الإصدارات...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit pour CVE-2023-47504. Selon le NIST, cette vulnérabilité devrait permettre aux utilisateurs non authentifiés d'accéder à des fonctionnalités dans le plugin Elementor Website Builder. Sur la base de mes recherches sur la vulnérabilité, et aussi en jugeant par l'URL de...

wp-allowed-hosts

المضيفين المسموحين لـ WP تم إنشاء هذه الإضافة بعد الكشف عن الثغرة المعروفة باسم CVE-2017-8295، هذه الإضافة ستحميك من ذلك الهجوم دون عناء، فقط أضف سطرًا بسيطًا إلى ملف wp-config.php الخاص بك. التثبيت ما عليك سوى تنزيل الإضافة من هنا ورفعها إلى موقعك. الاستخدام ما عليك سوى إضافة السطر التالي إلى مل...

wp-mail-masta-exploit

إكسبلويت لثغرة CVE-2016-10956 في إضافة ووردبريس Mail Masta 1.0 يستغل هذا السكربت الثغرة CVE-2016-10956 في إضافة ووردبريس Mail Masta 1.0 لاستخراج بيانات الاعتماد من wp-config.php. كيفية الاستخدام 1. استنسخ المستودع: root@kitploit: git clone https://github.com/Hakchoven/wp-mail-masta-exploit.git 2...

wphardening

WPHardening Fortify the security of any WordPress installation. ❮ NOTE ❯ This tool releases new versions on a regular basis. Make sure to update your dependencies frequently to get the latest version. Check out the changelog or CHANGELOG.md to learn about the new features. Installation Installing...

CVE-2024-6460

CVE-2024-6460 Grow من Tradedoubler 2.0.22 - ثغرة LFI غير مصادق عليها الاستخدام root@kitploit: usage: CVE-2024-6460.py -h -u URL -U USERNAME -P PASSWORD -c COMPONENT Grow by Tradedoubler 2.0.22 - Unauthenticated LFI options: -h, --help show this help message and exit -u URL, --url URL Target...

PT-2026-73086

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on...

CVE-2026-14484

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

EUVD-2026-58835

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

CVE-2026-73033

CVE-2026-73033 affects the Sucuri Security WordPress plugin up to version 2.7.3. A path traversal flaw exists in the pageIntegritySubmission() function (src/integrity.lib.php) that lets authenticated administrators delete arbitrary files by supplying directory traversal sequences via the sucurisc...

EUVD-2026-49989

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

EUVD-2026-39968

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...

CVE-2026-8095

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...

CVE-2026-8118

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wprgetcsvhandle helper introduced in version 1.7.1058 as part of the patch for CVE-2026-6229 falling back to...

CVE-2026-8118

The CVE concerns the WordPress plugin Royal Addons for Elementor – Addons and Templates Kit for Elementor (versions 1.7.1058–1.7.1059). A flaw in wpr_get_csv_handle(), introduced in 1.7.1058, allows an authenticated attacker with Contributor+ privileges to cause Arbitrary File Read by abusing set...

CVE-2016-20081

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the filepath parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to acces...

CVE-2016-20077

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoin...