CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes 테마 = 4.4.0 - 권한 상승 🔥 취약점 요약 WordPress 테마 RealHomes 버전 4.4.0 이하는 권한 상승 취약점 에 영향을 받습니다. 이로 인해 인증된 낮은 권한의 사용자예: 구독자가 관리자로 역할을 상승시킬 수 있습니다. 이 취약점은 inspiryupdateprofile 함수에서 발생하며, ereallowuserschangerole 옵션이 활성화된 경우 사용자가 자신의 역할을 변경할 수 있게 합니다. 이 문제는 admin-ajax.php...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab Drag and Drop Multiple File Upload for Contact Form 7 취약한 WordPress 환경을 실행하여 CVE-2025-3515를 재현하고 검증하세요 — 플러그인 drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8.9의 ddmuuploadfile을 통한 무제한 파일 업로드 취약점입니다. 이 랩은 Dockerized로 빠르고 결정적인 테스트를 위해 Nuclei와 함께 사용할 수 있습니다. 취약한...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - 인증 후 SQL 인젝션 Exploit 제목: WooCommerce Customers Manager 29.4 - 인증 후 SQL 인젝션 날짜: 2024-03-25 익스플로잇 작성자: Ivan Spiridonov - xbz0n 소프트웨어 링크: https://codecanyon.net/item/woocommerce-customers-manager/10965432 버전: 29.4 테스트 환경: Ubuntu 22.04 CVE:...

CVE-2026-90972

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

EUVD-2026-90515

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 docker and poc functions.php는 원본 이미지의 functions.php를 교체해야 하며, docker-compose.yml에서 직접 마운트하십시오. poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/20100101 Firefox/132.0 Accept:...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 취약 환경 이 환경은 Elementor Custom Skin 플러그인을 사용하여 CVE-2022-21661을 테스트하도록 설정되었습니다. 환경을 시작하려면 console wp-lab$ ./start.sh 관리자 비밀번호를 얻으려면 실행 중인 컨테이너의 로그를 확인하세요. 컨테이너가 부팅될 때마다 새 비밀번호가 생성됩니다. console $wp-lab$ docker logs test user admin pwd: inpJbxn+mhWWNSgEAlsU2A== localip:...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

PT-2026-99254

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3 Description An arbitrary file upload issue exists in the afrfq submit quote via popup function. The popup upload handler fails to validate file extensions and MIME types, using the raw...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

CVE-2026-12853

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853: Missing Authorization

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...

CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...