3122 matches found
Mass-CVE-2023-28121
CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User Introduction This script using Python3 and use threading for better process speed. The script has ben updated to 2 version. V1 is the old version and V2 the newer version with random username, ema...
CVE-2023-28121
CVE-2023-28121 WooCommerce Payments: Unauthorized Admin Access Exploit Won't be publishing this one first... thats for sure.. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
CVE-2026-108492
The Quick Paypal Payments plugin for WordPress (versions n/a through 6.0.3 ) is vulnerable to a Broken Access Control issue (CWE-862). The vulnerability stems from Missing Authorization , specifically allowing for the exploitation of incorrectly configured access control security levels within th...
WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Quick Paypal Payments versions = 6.0.3...
CVE-2026-46817
π¨ CVE-2026-46817 - Critical Remote Code Execution Oracle E-Business Suite β Oracle Payments File Transmission Critical unauthenticated remote vulnerability affecting Oracle Payments File Transmission that may allow complete compromise of the application over HTTP. π Overview CVE-2026-46817 is a...
WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection
WordPress Paytm Payment Gateway plugin through 2.7.3 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-45805 info: name: WordPress Payt...
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id
The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...
CVE-2023-28121
CVE-2023-28121 usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this help message an...
WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery
WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...
Mass-CVE-2023-28121-kdoec
CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User How to use This script using Python3. Install requirements pip install -r requirements.txt Reference https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...
CVE-2023-28121-WordPress-Privilege-Escalation
π CVE-2023-28121 β WordPress Privilege Escalation Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin. π Summary CVE-2023-28121 allows creating administrator users without authentication via the REST API. Severity: Critical CVSS 9.8 Impact: Full...
CVE-2023-28121
CVE-2023-28121 Research notes and helper material for studying CVE-2023-28121 in a controlled WordPress/WooCommerce Payments lab. Safety Notice Use this material only in systems you own or have explicit authorization to test. Keep vulnerable WordPress and plugin versions inside an isolated local...
CVE-2026-14335
The Easy Digital Downloads β eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-105990
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
CVE-2026-105989 Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...
CVE-2026-105990 Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
CVE-2026-105989
The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions before 4.0.7 , is vulnerable to unauthenticated transaction status forgery. The root cause is a lack of authorization and request-validation checks on one of its AJAX actions. This allows an unauthenticated attacker to ...
CVE-2026-105990
The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7 , is vulnerable to an unauthenticated PII disclosure . The root cause is a lack of authorization checks when exporting stored form submissions. This flaw allows unauthenticated attackers to download sensi...
CVE-2026-106360
An information leak flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/535639435...
CVE-2026-103329
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...