CVE-2026-19660

CVE-2026-14378 — обход аутентификации в DevKit Pro PoC Сканер и вспомогательный эксплойт для проверки концепции CVE-2026-14378 : неаутентифицированный захват сессии администратора в плагине WordPress DevKit Pro dplugins через некорректный поток «возврата» при переключении пользователя. Правовая...

CVE-2025-5947_Exploit

🔍 Эксплойт плагина WordPress — Service Finder sf-booking Обзор Плагин Service Finder — это система бронирования и управления услугами для WordPress. Из-за его популярности и сложности в некоторых версиях были обнаружены проблемы безопасности, связанные с неаутентифицированными AJAX-эндпоинтами ил...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2026-14378-DevKit-Pro-Auth-Bypass

CVE-2026-14378 — Обход аутентификации без учётных данных в плагине WordPress DevKit Pro -red.svg Содержание 1. Краткое резюме 2. Разбор уязвимости 3. Первопричина и технический анализ 4. Полный разбор атаки пошагово Шаг 0: Настройка окружения Шаг 1: Подтверждение установки и уязвимости плагина Ша...

CVE-2026-14378

CVE-2026-14378 — обход аутентификации в DevKit Pro PoC Сканер-доказательство концепции и вспомогательный эксплойт для CVE-2026-14378 : неаутентифицированный захват сессии администратора в плагине WordPress DevKit Pro dplugins через некорректный поток «возврата» при переключении пользователя...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2026-14378

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378 DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378

The DevKit Pro plugin for WordPress (versions ≤ 2.3.0 ) is vulnerable to an Authentication Bypass leading to full Administrator Account Takeover . The root cause is a flawed user-switch "revert" flow where the revert_switch handler trusts the attacker-controlled original_user_id cookie to identif...

CVE-2026-14378 DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

EUVD-2026-91165

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378: Improper Authentication

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

WordPress DevKit Pro plugin <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via 'originaluserid' Cookie in Frontend Revert Switch Flow vulnerability discovered by h0xilo in WordPress Plugin DevKit Pro versions = 2.3.0...