600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

CVE-2024-8484

CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - Unauthenticated SQL Injection CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram Description: The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the...

CVE-2024-44313

Exploit 🛠️ Case Study: CVE-2024-44313 and EPSS in Vulnerability Prioritization This case study was developed for a talk on EPSS Exploit Prediction Scoring System, demonstrating how the score can influence vulnerability prioritization in practice. The CVE-2024-44313 vulnerability, found in...

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

CVE-2024-33911

The School Management 10.3.4 - Post-Authenticated SQL Injection Exploit Title: The School Management 10.3.4 - Post-Authenticated SQL Injection Date: 29 April, 2024 Exploit Author: Ivan Spiridonov xbz0n Vendor Homepage: https://theschool-management.com Version: 10.3.4 Tested on: Ubuntu 22.04 CVE:...

CVE-2026-92429

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and...

CVE-2026-92428

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or complete...

CVE-2026-92429 Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and...

CVE-2026-92429

The Rede Itaú for WooCommerce WordPress plugin (versions before 5.5.3 ) is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify the authenticity of a payment gateway webhook before updating an order's status. An unauthenticated attacker can exploit this t...

CVE-2026-92429 Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and...

WordPress Rede Itaú for WooCommerce plugin 3.7.1-5.5.2 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Rede Itaú for WooCommerce versions 3.7.1-5.5.2...

CVE-2026-92428 Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or complete...

EUVD-2026-101861

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or complete...

CVE-2026-92428

The Rede Itaú for WooCommerce WordPress plugin, in versions prior to 5.5.3 , is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify the authenticity of a payment gateway webhook before updating an order's status. This allows an unauthenticated attacker t...

CVE-2026-92428 Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or complete...

WordPress Rede Itaú for WooCommerce plugin < 5.5.3 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Rede Itaú for WooCommerce versions 5.5.3...

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...

CVE-2026-103324 Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...

CVE-2026-103324 Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...