freemius-exploit

freemius-exploit Freemius 库 2.2.4 - 订阅者及以上任意选项更新 描述 该库被众多插件广泛使用，在更新博客选项时缺少适当的授权检查，导致任何已认证用户（例如订阅者）都能更新任意选项。 用法 usage: exploit.py -h -u URL -un USERNAME -p PASSWORD -f FIX Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Description: The library, used in numerous plugins, does not have...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - 認証なしの任意オプション更新 説明 このプラグインは、RESTエンドポイントを介してオプションを更新する際に認可とCSRFチェックを行わず、更新対象のオプションがプラグインに属していることも確認しません。その結果、認証されていない攻撃者が、userscanregister や defaultrole などの任意のブログオプションを変更し、新しい管理者アカウントを作成してブログを乗っ取ることが可能になります。 例: 管理者と登録を有効にする $ python3 CVE-2022-0952.py -u...

CVE-2024-11643

CVE-2024-11643 Accessibility by AllAccessible history.pushState'', '', '/'; document.forms0.submit; ユーザー登録可能 input type="hidden" name="action" value="AllAccessiblesave&9...

CVE-2023-47179

CVE-2023-47179 WooODT Lite = 2.4.6 - 認可欠如による任意のオプション更新（Subscriber以上） 説明: WordPress向けWooODT Liteプラグインは、バージョン2.4.6以前において、AJAX経由でフックされたbyconsolewooodtadminfieldssettingfiles関数に対する権限チェックが欠如しているため、データの不正な変更に対して脆弱です。これにより、認証された攻撃者（Subscriber以上の権限を持つ者）が任意のサイトオプションを変更できるようになり、容易に権限昇格に悪用される可能性があります。...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - 購読者+ 任意オプション更新 説明 Content Mask WordPressプラグインの1.8.4.1より前のバージョンには、さまざまなAJAXアクションにおいて認可チェックとCSRFチェックがなく、また、更新されるオプションがプラグインに属していることを検証しません。その結果、購読者などの認証済みユーザーがブログの任意のオプションを変更できる可能性があります。 使用方法 エクスプロイト $ python3 CVE-2022-1203.py -u http://wordpress.lan -un user -p...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 概念実証 これは、WordPress Elementor Proプラグインの脆弱性CVE-2023-3124に対する概念実証（PoC）エクスプロイトです。 説明: WordPress用Elementor Proプラグインは、バージョン3.11.6以前において、updatepageoption関数に対する能力チェックが欠如しているため、不正なデータ変更に対して脆弱です。これにより、購読者レベルの権限を持つ認証済み攻撃者が任意のサイトオプションを更新でき、権限昇格につながる可能性があります。 注記:...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840

The Notiqoo WordPress plugin (specifically the Order Notification & Customer Chat for WooCommerce plugin) versions before 1.4.14 is vulnerable to an incorrect authorization flaw. The plugin fails to perform adequate capability checks on several of its AJAX actions and constructs the name of the o...

WordPress Newsletters plugin < 4.17 - Arbitrary Plugin Option Update vulnerability

Arbitrary Plugin Option Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-75982

The LearnPress WordPress plugin (versions up to and including 4.4.4 ) is vulnerable to unauthorized modification of arbitrary WordPress options via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce (both a...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

EUVD-2026-64207

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...

CVE-2026-75860 JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...