CVE-2025-5947_Exploit

🔍 WordPress Plugin Exploit — Service Finder sf-booking Overview The Service Finder plugin is a booking and service management system for WordPress. Because of its popularity and complexity, some versions have had security issues related to unauthenticated AJAX endpoints or improper access control...

CVE-2026-14378-DevKit-Pro-Auth-Bypass

CVE-2026-14378 — Unauthenticated Authentication Bypass in WordPress DevKit Pro Plugin -red.svg Table of Contents 1. Executive Summary 2. Vulnerability Breakdown 3. Root Cause & Technical Analysis 4. Full Attack Walkthrough Step-by-Step Step 0: Environment Setup Step 1: Confirm Plugin Is Installed...

CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2026-14378

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

EUVD-2026-91165

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378 DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378 DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378

The DevKit Pro plugin for WordPress (versions ≤ 2.3.0 ) is vulnerable to an Authentication Bypass leading to full Administrator Account Takeover . The root cause is a flawed user-switch "revert" flow where the revert_switch handler trusts the attacker-controlled original_user_id cookie to identif...

CVE-2026-14378: Improper Authentication

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

WordPress DevKit Pro plugin <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via 'originaluserid' Cookie in Frontend Revert Switch Flow vulnerability discovered by h0xilo in WordPress Plugin DevKit Pro versions = 2.3.0...