CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – WP Staging & Migration en 1 clic = 0.1.0.38 - Absence d'autorisation menant à une configuration API non authentifiée / mise à jour d'options arbitraires / création d'utilisateur administratif...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Отсутствие авторизации для произвольного обновления параметров Описание Плагин Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX для WordPress уязвим к несанкционированной модификации...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Absence d'autorisation permettant la mise à jour arbitraire d'options Description Le plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX pour WordPress est vulnérable à une...

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

WordPress Image Hover Ultimate - Unauthenticated Settings Update

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate versions = 9.6.1 WordPress plugin. id: CVE-2021-36888 info: name: WordPress Image Hover Ultimate - Unauthenticated Settings Update author: riteshs4hu severity:...

CVE-2025-13342

CVE-2025-13342 Frontend Admin от DynamiApps - ----/| |/ ----| \ ||/ / / / //// |// |/...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Отсутствие авторизации для аутентифицированных Подписчик+ произвольное обновление опций Описание Плагин Minterpress для WordPress уязвим к несанкционированному изменению данных, что может привести к повышению привилегий из-за отсутствия проверки возможностей в...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Absence d'autorisation à une mise à jour d'options arbitraires par un utilisateur authentifié Abonné+ Description Le plugin Quietly Insights pour WordPress est vulnérable à une modification non autorisée des données pouvant conduire à une escalade de...

CVE-2023-6700

CVE-2023-6700 Cookie Information | Solution de consentement GDPR gratuite = 2.0.22 - Mise à jour arbitraire des options par un utilisateur authentifié Abonné+ Description : CVE-2023-6700 Le plugin Cookie Information | Solution de consentement GDPR gratuite pour WordPress est vulnérable aux mises ...

CVE-2025-2266

🚨 CVE-2025-2266 — Эксплойт для плагина WordPress 🔍 Сводка об уязвимости Плагин Checkout Mestres do WP for WooCommerce для WordPress подвержен уязвимости неаутентифицированного обновления произвольных параметров в версиях с 8.6.5 по 8.7.5. Уязвимая функция cwmpUpdateOptions не содержит надлежащих...

CVE-2025-13342

CVE-2025-13342 PoC Le plugin Frontend Admin by DynamiApps pour WordPress est vulnérable à une modification non autorisée d'options WordPress arbitraires dans toutes les versions jusqu'à et y compris la 3.28.20. Cela permet aux attaquants d'enregistrer des utilisateurs et de définir le rôle par...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Неавторизованное Subscriber+ обновление произвольных параметров Описание Плагин HyperComments для WordPress уязвим к несанкционированной модификации данных, которая может привести к повышению привилегий, из-за отсутствия проверки прав в функции hcrequesthandl...

CVE-2024-50476

CVE-2024-50476 GRÜN spendino Spendenformular = 1.0.1 - Aggiornamento non autenticato di opzioni arbitrarie Descrizione: Il plugin GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! per WordPress è vulnerabile alla modifica non autorizzata dei dati, che può portare a un escalation dei...

CVE-2024-50490

CVE-2024-50490 PegaPoll = 1.0.2 - Aggiornamento arbitrario delle opzioni non autenticato Descrizione: Il plugin PegaPoll per WordPress è vulnerabile a modifiche non autorizzate dei dati che possono portare a escalation dei privilegi a causa della mancanza di un controllo delle capacità in tutte l...

CVE-2026-75860 JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...

CVE-2026-75860

The JSON Options WordPress plugin (versions through 0.0.4) exposes an unauthenticated action on every request without capability checks or nonce verification, allowing arbitrary option updates. An attacker can enable user registration and set the default role to administrator, achieving privilege...

CVE-2026-6897

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\TeamAccounts::savesettings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with...

CVE-2026-6897

The CVE describes a missing capability check in Wishlist Member for WordPress (WishListMember\Features\Team_Accounts::save_settings) affecting all versions up to and including 3.30.1. This allows authenticated users with Subscriber-level access or higher to modify arbitrary plugin options, includ...

CVE-2026-3596 Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action

The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2. The plugin registers an unauthenticated AJAX action 'wpajaxnoprivinstall-imprint' that maps to the inkpdaddoption function. This function reads 'option' and...

WordPress BackWPup plugin <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update vulnerability

Authenticated BackWPup Helper+ Privilege Escalation via Arbitrary Options Update vulnerability discovered by 0N0ise - cert.pl in WordPress Plugin BackWPup versions = 5.6.2...