Kirki CVE-2026-13147 SSRF detect

Detects Kirki str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/": suffix = "/" + suffix return f"basesuffix" if base != "/" else suffix def runself: base = self.wpnormalizebasepathself.basepath or "/" version = self.wpplugi...

MemberGlut CVE-2026-12394 privilege escalation detect

Detects CVE-2026-12394 in MemberGlut WordPress plugin 1.1.5: front-end registration accepts defaultrole=administrator without validation. Confirms register form, version, and optionally registers a throwaway admin account. !/usr/bin/env python3 -- coding: utf-8 -- """MemberGlut 1.1.5...

OttoKit CVE-2026-110372 connection-denied detect

Detects CVE-2026-110372: when OttoKit stores secret 'connection-denied', st-authorization: Bearer connection-denied allows unauthenticated automation API user creation. !/usr/bin/env python3 -- coding: utf-8 -- """OttoKit SureTriggers = 1.1.40 connection-denied API secret bypass CVE-2026-110372."...

Prodigy Commerce CVE-2026-0926 LFI detect

Detects CVE-2026-0926 via prodigy-render-my-account-widget and parameterstemplatename=etc/passwd traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Prodigy Commerce str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/":...

Profile Builder CVE-2026-15826 detect

Detects CVE-2026-15826: 61+ char username triggers absintWPError→1 autologin nonce. !/usr/bin/env python3 -- coding: utf-8 -- """Profile Builder 3.16.4 autologin bypass CVE-2026-15826.""" import re import secrets import string from kittysploit import from lib.protocols.http.httpclient import...

Realtyna WPL CVE-2026-14483 upload detect

Detects CVE-2026-14483: WPL io endpoint accepts multipart upload with hardcoded publickey/privatekey. !/usr/bin/env python3 -- coding: utf-8 -- """Realtyna WPL str: base = self.wpnormalize...

Slider Future CVE-2026-1405 upload detect

Detects CVE-2026-1405: POST /wp-json/slider-future/v1/upload-image/ fetches remote imageurl and stores under wp-content. !/usr/bin/env python3 -- coding: utf-8 -- """Slider Future str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/": suffix = "/" + suffix return...

User Registration CVE-2025-2563 detect

Detects CVE-2025-2563 = 4.1.1: userregistrationmembershipregistermember accepts role=administrator in membersdata JSON. !/usr/bin/env python3 -- coding: utf-8 -- """User Registration & Membership = 4.1.1 role injection CVE-2025-2563.""" import json import re import secrets from datetime import da...

Wholesale Lead Capture CVE-2026-27542 detect

Detects unauthenticated wwlccreateuser AJAX returning registration form schema. !/usr/bin/env python3 -- coding: utf-8 -- """WooCommerce Wholesale Lead Capture str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/": suffix = "/" + suffix retur...

W3 Total Cache CVE-2026-9282 minify LFI detect

Detects manual minify cache URLs and probes farray traversal for wp-config markers. !/usr/bin/env python3 -- coding: utf-8 -- """W3 Total Cache = 2.9.4 minify LFI CVE-2026-9282.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

wpForo CVE-2026-1581 SQLi probe

GET wpfob parameter with SLEEP for manual timing confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """wpForo CVE-2026-1581 — wpfob sleep injection.""" import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress...

Hippoo CVE-2026-49060 detect

Detects unauthenticated GET of wp/v2/users/1 via wc-hippoo REST bridge. !/usr/bin/env python3 -- coding: utf-8 -- """Hippoo str: base = self.wpnormalizebasepathself.basepath or "/" if not...

JoomSport CVE-2026-42647 SQLi detect

Time-based blind SQLi via playerlist sortf GET parameter. !/usr/bin/env python3 -- coding: utf-8 -- """JoomSport str: bas...

Newsletters CVE-2026-3018 SQLi detect

Time-based SQLi on newsletter-management unsubscribe wpmlsubscriberid. !/usr/bin/env python3 -- coding: utf-8 -- """Newsletters str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/": suffix = "/" + suffix return f"basesuffix" if base != "/" else suffix...

Post SMTP CVE-2025-11833 detect

Detects unauthenticated email log read via lostpassword + postmanemaillog view. !/usr/bin/env python3 -- coding: utf-8 -- """Post SMTP = 3.6.0 email log disclosure CVE-2025-11833.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress...

RestroPress CVE-2025-9209 JWT bypass detect

Detects CVE-2025-9209: RestroPress = 3.2.1 exposes forged JWT via GET /wp-json/rp/v1/auth?userid= for unauthenticated callers. !/usr/bin/env python3 -- coding: utf-8 -- """RestroPress 3.0.0–3.2.1 JWT auth bypass CVE-2025-9209.""" import re from kittysploit import from lib.protocols.http.httpclien...

W3 Total Cache CVE-2026-18051 detect

Detects CVE-2026-18051: search query cache poisoning writes attacker marker into pageenhanced cache files. !/usr/bin/env python3 -- coding: utf-8 -- """W3 Total Cache str: base = self.wpnormalizebasepathself.basepath or "/" if not suffix.startswith"/": suffix = "/" + suffix return...

ACF Extended CVE-2025-13486 admin user create

CVE-2025-13486: abuses acfe/form/renderformajax with formrender=wpinsertuser to register an administrator and output credentials; wp-login may set cookies on the module HTTP client only. !/usr/bin/env python3 -- coding: utf-8 -- """ACF Extended CVE-2025-13486 — wpinsertuser via renderformajax."""...

Divi Plus CVE-2026-91136 file read

GET dipl-modules/svg-animator?svgimage= arbitrary read. !/usr/bin/env python3 -- coding: utf-8 -- """Divi Plus CVE-2026-91136 — svgimage LFI via REST.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class...

DynamiApps Frontend Admin CVE-2025-13342 BAC

Sets userscanregister=1 and defaultrole=administrator via frontendadmin/formsubmit. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2025-13342 — Frontend Admin unauthenticated wp options update.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...