CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - 인증되지 않은 설정 내보내기를 허용하는 권한 누락 설명 Swift Performance Lite 플러그인은 WordPress에서 모든 버전최대 2.3.6.14 포함에서 admininit 함수를 통해 연결된 기능에 대한 기능 검사capability check가 누락되어 데이터에 대한 무단 접근에 취약합니다. 이로 인해 인증되지 않은 공격자가 Cloudflare API 토큰을 포함할 수 있는 플러그인 설정을 내보낼 수 있습니다...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite 확장 프로그램 개요 이 Python 기반 Burp Suite 확장 프로그램은 CVE-2025-31324 를 탐지하기 위해 설계되었습니다. 이는 SAP NetWeaver Visual Composer의 Metadata Uploader 구성 요소에 존재하는 심각한 취약점으로, 인증 확인 누락으로 인해 인증되지 않은 원격 코드 실행을 허용합니다. 이 확장 프로그램은 /developmentserver/metadatauploader 엔드포인트에 테스트 파일을 전송하여 활성 스캔을 수행하고...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Отсутствие авторизации для произвольного обновления опций Описание Плагин Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX для WordPress уязвим к несанкционированному изменению данных...

CVE-2026-78467

The Fluent Support Pro WordPress plugin is affected by a missing capability check on a function, present in all versions up to and including 2.3.1 . An authenticated attacker with Subscriber-level access or higher can perform an unauthorized action, resulting in a low integrity impact. The CVSS 3...

CVE-2026-78467 Fluent Support Pro <= 2.3.1 - Missing Authorization

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

CVE-2026-70481

CVE-2026-70481 Open WebUI, затронуты версии с 0.5.0 по 0.10.2, исправлено в 0.11.0. Умеренный уровень, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 и CWE-862. В backend/openwebui/routers/channels.py обработчики обновления и удаления сообщений ветвятся в зависимости от типа...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 - 認可の欠如による未認証の任意オプション更新 説明 WordPress用プラグインAgency...

CVE-2026-4106

CVE-2026-4106: Эксплойт неавторизованного раскрытия PII в WordPress HT Mega Надёжный многопоточный эксплойт Proof of Concept PoC для CVE-2026-4106 , нацеленный на плагин HT Mega - Absolute Addons for Elementor для WordPress версии 3.0.7. Обзор уязвимости Плагин HT Mega регистрирует несколько хуко...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Опубликовано : 26 июня 2026 Последнее обновление : 27 июня 2026 Исследователь : Netwurm - VTDR e.V.i.G. Описание уязвимости Плагин WP Full Stripe Free для WordPress уязвим к Отсутствию авторизации в версиях до 8.4.3 включительно через AJAX-действие...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS 명령 주입 POC 영향을 받는 genieacs 패키지, 버전 =1.2.0 1.2.8 수정 방법? genieacs를 버전 1.2.8 이상으로 업그레이드하세요. 이 패키지의 영향을 받는 버전은 ping 호스트 인수lib/ui/api.ts 및 lib/ping.ts를 통한 명령 주입에 취약하며, 이는 불충분한 입력 검증과 누락된 인가 확인이 결합되어 발생합니다...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - 인증되지 않은 콘텐츠 스푸핑 CVE-2025-32259 🔬 WordPress용 WP ULike 플러그인의 CVE-2025-32259를 시연하는 간단한 PoC입니다. 🚨 교육 목적으로만 사용하세요 – 명시적 승인 없이 시스템을 테스트하지 마세요. 🧠 개요 WP ULike는 사이트에서 사용자가 콘텐츠에 좋아요를 표시할 수 있게 해주는 인기 있는 WordPress 플러그인입니다. 4.7.9.1까지의 버전에는 인증 누락 취약점 이 존재하며, 인증되지 않은 사용자가 AJAX 요청을 통해 "좋아요"...

CVE-2022-36539

CVE-2022-36539 安全でない直接オブジェクト参照 IDOR WeDayCare B.V. WeDayCare B.V Ouderapp の v1.1.22 より前のバージョンでは、攻撃者が傍受した呼び出し内の ID 値を変更して、他の保護者や子供のデータにアクセスできる可能性があります。 API とのトラフィックは、Burp Suite などのプロキシを介して透過的に行われます。認証なしではアクセスできませんが、認可は適用されていないようです。このため、自分の子供のデータだけでなく、他の子供のデータも要求できます。これにより、GDPR...

CVE-2023-26035

CVE-2023-26035 Неаутентифицированное RCE в ZoneMinder Snapshots — PoC-эксплойт alt img Описание Версии ZoneMinder до 1.36.33 и 1.37.33 уязвимы для неаутентифицированного удалённого выполнения кода из-за отсутствия проверок авторизации в действии snapshot. Использование root@kitploit: git clone...