CVE-2025-39459-Nuclei-Template

📄 CVE-2025-39459 的 Nuclei 模板 🚀 概述 本仓库包含一个专为检测 Real Estate 7 WordPress 主题 中的 未认证权限提升漏洞 CVE-2025-39459 而设计的 Nuclei 模板。该漏洞允许未认证的攻击者通过存在缺陷的 AJAX 操作注册为管理员。 🔍 漏洞描述 CVE-2025-39459 源于 Real Estate 7 WordPress 主题 版本 3.5.2 及更早版本中对 ctaddnewmember AJAX 操作缺少授权检查。这允许未认证的攻击者通过操控 ctuserrole 参数以管理员权限注册。 🛑 受影响版本 Re...

CVE-2020-36708

CVE-2020-36708 – WordPress Epsilon Framework 函数注入 PoC 概述 CVE-2020-36708 是 WordPress 的 Epsilon Framework 中的一个漏洞，它允许未经身份验证的攻击者通过 AJAX 操作 epsilonframeworkajaxaction 调用任意 PHP 类方法。 此问题被归类为函数注入漏洞 ，因为攻击者可以同时控制： 要调用的类 （例如 Requests） 要调用的方法 （例如 requestmultiple） 要提供的参数 实际上，攻击者可以指示框架执行本不应暴露的 PHP 函数或库调用。...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 suffers from an IDOR (Insecure Direct Object Reference) in its AI image-editing AJAX action. The plugin fails to verify that the caller owns or can edit the target listing before performing media operations, allowing any authenticated user—incl...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 描述 Error Log Viewer By WP Guru 这个 WordPress 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 ⚙️ 安装所需的软件包 root@kitploit: pip install requests ⚙ 检查版本并下载默认文件 示例命令 root@kitploit: python CVE-2024-12849.py -u...

js-jobs

js-jobs JS Job Manager 要激活插件（此处存在一个限制：插件必须包含 /.php 文件，否则将无法激活）： root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page history.pushState'', '', '/'; document.forms0.submit; root@kitploit: "success":true,"data":"tempurl":"https://wp-dev.ddev.site?tempaccess=Osn6apJoSJunYNqOhDsn&userid=1","message":"Tempo...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - 缺少授权导致未认证的任意文件读取 描述 WordPress 的 Error Log Viewer By WP Guru 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使得未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 详情 类型 : 插件 Slug : error-log-viewer-wp 受影响版本 : 1.0.1.3 CVSS 分数 : 7.5 CVSS...

Youzify < 1.2.0 - Unauthenticated SQLi

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

WordPress KiviCare <2.3.9 - SQL Injection

WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route. An attacker can possibly obtain sensitive information, modify...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

CVE-2021-24499

CVE-2021-24499 | Workreap - 自由职业者市场和目录 WordPress 主题 2.2.2 - 任意文件上传 WordPress 主题 Workreap 2.2.2 - 未认证文件上传导致远程代码执行 一个功能强大且精准的大规模利用工具，针对 WordPress Workreap 主题中的 CVE-2021-24499 漏洞。该利用程序允许未经认证的文件上传，从而可能导致远程代码执行（RCE）。 📝 描述 CVE-2021-24499 是 WordPress Workreap 主题（2.2.2 及以下版本）中的一个严重漏洞，它允许未经认证的用户通过...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus ≤ 2.0.8 — 缺少授权导致已认证（订阅者+）站点重置和权限提升 CVE-2025-14364 — Demo Importer Plus · 全站重置 → 权限提升 root@kitploit: / \ / | / \ | /| || | || \ / | / / / | | | | 已认证的订阅者 → 管理员，通过do-reinstall AJAX 动作 〔 1 〕 漏洞 根本原因： Ajax::handlerequest 注册了 demoimporterplus AJAX 动作，但未调用...

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

EUVD-2025-210831

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-15489

The Passster WordPress plugin before version 4.2.24 contains an improper input handling flaw in an AJAX action , allowing unauthenticated users to retrieve the value of password-protected content. This constitutes a password protection bypass , with a CVSS 3.1 score of 5.3 (Medium) reflecting net...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - 通过 wpajaxnoprivshortcodeApiAdd 实现未经认证的任意短代码执行 描述 WordPress 的 WP Popup Builder – Popup Forms and Marketing Lead Generation 插件在 1.3.5 及之前的所有版本中，容易受到通过 wpajaxnoprivshortcodeApiAdd AJAX...