WordPress Plugin Easy WP SMTP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2021-24779 WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update

The WP Debugging WordPress plugin before 2.11.0 has its updatesettings function hooked to admininit and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users...

WordPress Download Manager < 3.1.18 - Unauthorised Download Duplication

The duplicate method, hooked to the admininit action did not have any CSRF and authorisation checks, allowing unauthorised users such as unauthenticated ones to duplicate arbitrary downloads PoC As an unauthenticated or authenticated user, open the following URL to duplicate the Download with id...

10Web Map Builder for Google Maps < 1.0.64 - Unauthenticated Stored XSS via Plugin Settings Change

The vulnerability in 10Web Map Builder exists in the plugin’s setup process. The plugin’s setup functions are called during admininit which, like Flexible Checkout Fields, is accessible to unauthenticated users. If an attacker injects malicious JavaScript into certain settings values, that code...

Exploit for Missing Authentication for Critical Function in Getigniteup Igniteup

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plu...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

Design/Logic Flaw

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11006

CVE-2016-11006 affects the WP-Invoice WordPress plugin prior to version 4.1.1. The root issue is incorrect access control for admin_init settings changes, enabling potential unauthorized modification of settings. Public details list this as a privilege/permission-related flaw with a medium-severi...

Search Exclude < 1.2.4 - Arbitrary Settings Change

Unauthenticated plugin settings change via admininit Authenticated plugin settings change via AJAX...

Vulnerability analysis: WordPress image plugin Fancybox-For-WordPress vulnerability to cause the batch hung it-vulnerability warning-the black bar safety net

! Fancybox For WordPress is a great WordPress picture plugin, it can make your WordPress images pop up a nice browsing interface, showing the rich pop-up layer effect. Last week security researchers found that some Wordpress blogs suffered a batch hung it, and these blogs have in common is to...

WordPress Platform Theme Remote Code Execution Exploit

The Wordpress Theme "platform" contains a remote code execution vulnerability through an unchecked admininit call. The theme includes the uploaded file from it's temp filename with php's include function. This module requires Metasploit: http://metasploit.com/download Current source:...

WordPress Platform Theme File Upload Vulnerability

The WordPress Theme "platform" contains a remote code execution vulnerability through an unchecked admininit call. The theme includes the uploaded file from its temp filename with php's include function. Module Options msf use exploit/unix/webapp/wp/platformexec msf undefinedplatformexec show...

Wordpress MailPoet (wysija-newsletters) Unauthenticated File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::HTTP::Wordpress include...

Wordpress MailPoet (wysija-newsletters) Unauthenticated file Upload

The Wordpress plugin "MailPoet Newsletters" wysija-newsletters before 2.6.7 is vulnerable to an unauthenticated file upload. The exploits uses the upload Theme functionality to upload a zip file containing the payload. The plugin used the admininit hook without knowning the hook is also executed...

Critical Vulnerability in Wordpress Plugin Could Allow Site Takeover

WordPress users that have a popular plugin installed are being cautioned to upgrade immediately. A vulnerability in the plugin, MailPoet, could essentially allow an attacker to take over any site running it without authentication. MailPoet, formerly Wysija, allows developers running WordPress to...

Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload

The Wordpress plugin "MailPoet Newsletters" wysija-newsletters before 2.6.8 is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme functionality to upload a zip file containing the payload. The plugin uses the admininit hook, which is also executed for unauthenticated...