lab-cve-2025-3515

CVE-2025-3515 WordPress Lab（用于Contact Form 7的拖放多文件上传） 快速搭建一个易受攻击的WordPress环境，以复现并验证CVE-2025-3515——插件drag-and-drop-multiple-file-upload-contact-form-7（≤ 1.3.8.9）中通过ddmuuploadfile实现的无限制文件上传。此实验环境已Docker化，可使用Nuclei快速、确定性地进行测试。 易受攻击的插件：drag-and-drop-multiple-file-upload-contact-form-7 v1.3.8.9...

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes 主题 = 4.4.0 - 权限提升 🔥 漏洞概要 WordPress 主题 RealHomes 版本 = 4.4.0 存在一个权限提升漏洞 。这允许具有低权限（例如订阅者）的认证用户将其角色提升为管理员。该漏洞通过 inspiryupdateprofile 函数发生，该函数在 ereallowuserschangerole 选项启用时不当允许用户更改其角色。 该问题可通过向 admin-ajax.php 端点提交特制的 POST 请求来利用，提供设置为 administrator 的 realhomesuserrol...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - 认证后SQL注入 漏洞名称： WooCommerce Customers Manager 29.4 - 认证后SQL注入 日期： 2024-03-25 漏洞作者： Ivan Spiridonov - xbz0n 软件链接： https://codecanyon.net/item/woocommerce-customers-manager/10965432 版本： 29.4 测试环境： Ubuntu 22.04 CVE编号： CVE-2024-0399 SQL注入...

CVE-2026-90972

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

EUVD-2026-90515

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 docker and poc functions.php需要替换原本镜像里的functions.php，docker-compose.yml里直接挂载进去 poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/20100101 Firefox/132.0 Accept:...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 漏洞环境 该环境使用 Elementor Custom Skin 插件搭建，用于测试 CVE-2022-21661。 启动环境 console wp-lab$ ./start.sh 要获取管理员密码，请查看运行中容器的日志，每次容器启动都会生成新密码。 console $wp-lab$ docker logs test user admin pwd: inpJbxn+mhWWNSgEAlsU2A== localip: 172.17.0.2 要运行漏洞利用，请将 替换为： 1. 导出数据库名称 2. 导出用户表 python3...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

PT-2026-99254

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3 Description An arbitrary file upload issue exists in the afrfq submit quote via popup function. The popup upload handler fails to validate file extensions and MIME types, using the raw...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

CVE-2026-12853

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853: Missing Authorization

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...

CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...