CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - 認証なしの任意オプション更新 説明 このプラグインは、RESTエンドポイントを介してオプションを更新する際に認可とCSRFチェックを行わず、更新対象のオプションがプラグインに属していることも確認しません。その結果、認証されていない攻撃者が、userscanregister や defaultrole などの任意のブログオプションを変更し、新しい管理者アカウントを作成してブログを乗っ取ることが可能になります。 例: 管理者と登録を有効にする root@kitploit: $ python3...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

CVE-2024-11643

CVE-2024-11643 Accessibility by AllAccessible history.pushState'', '', '/'; document.forms0.submit; ユーザー登録可能 root@kitploit: input type="hidden" name="action...

CVE-2023-47179

CVE-2023-47179 WooODT Lite = 2.4.6 - 認可欠如による任意のオプション更新（Subscriber以上） 説明: WordPress向けWooODT Liteプラグインは、バージョン2.4.6以前において、AJAX経由でフックされたbyconsolewooodtadminfieldssettingfiles関数に対する権限チェックが欠如しているため、データの不正な変更に対して脆弱です。これにより、認証された攻撃者（Subscriber以上の権限を持つ者）が任意のサイトオプションを変更できるようになり、容易に権限昇格に悪用される可能性があります。...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - 订阅者+ 任意选项更新 描述 Content Mask WordPress 插件在 1.8.4.1 之前的版本中，多个 AJAX 操作缺少授权和 CSRF 检查，同时也没有验证要更新的选项以确保其属于该插件。因此，任何已认证用户（例如订阅者）都可以修改任意博客选项。 使用方法 漏洞利用 root@kitploit: $ python3 CVE-2022-1203.py -u http://wordpress.lan -un user -p useruser1 The plugin version is below...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 概念実証 これは、WordPress Elementor Proプラグインの脆弱性CVE-2023-3124に対する概念実証（PoC）エクスプロイトです。 説明: WordPress用Elementor Proプラグインは、バージョン3.11.6以前において、updatepageoption関数に対する能力チェックが欠如しているため、不正なデータ変更に対して脆弱です。これにより、購読者レベルの権限を持つ認証済み攻撃者が任意のサイトオプションを更新でき、権限昇格につながる可能性があります。 注記:...

freemius-exploit

freemius-exploit Freemius 库 2.2.4 - 订阅者及以上任意选项更新 描述 该库被众多插件广泛使用，在更新博客选项时缺少适当的授权检查，导致任何已认证用户（例如订阅者）都能更新任意选项。 用法 root@kitploit: usage: exploit.py -h -u URL -un USERNAME -p PASSWORD -f FIX Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Description: The library, used in numerous plugins...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840

The Notiqoo WordPress plugin before 1.4.14 lacks capability checks on several of its AJAX actions and constructs the name of the option to write from user input. This allows users with a role as low as contributor to modify arbitrary WordPress options. The practical consequence is the ability to ...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Unauthenticated IAB TCF Consent Option Update vulnerability

Unauthenticated IAB TCF Consent Option Update vulnerability discovered by Alex Spataru in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-17553

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.9.3 . The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly into update_option() without an allowlist. Access is gated on the manage_op...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-75982

The LearnPress WordPress plugin (versions up to and including 4.4.4 ) is vulnerable to unauthorized modification of arbitrary WordPress options via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce (both a...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-19883

The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...

EUVD-2026-64207

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

CVE-2026-12736

The WPify Woo plugin (WordPress) is vulnerable up to version 5.4.16 via SettingsApi::save_option() at POST /wp-json/wpify-woo/v1/option. The route forwards request-supplied options and data to update_option() without an allowlist or sanitization, while permission_callback checks only manage_wooco...