CVE-2025-13486-POC

CVE-2025-13486 Proof of Concept A Proof of Concept PoC exploit for CVE-2025-13486, a Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin. Vulnerability Overview This vulnerability exists in ACFE versions 0.9.0.5 through 0.9.1.1, allowing unauthenticat...

WordPress_Backup_Migration-RCE_Unauthenticated

CVE-2023-6553 — The Backup Migration plugin for WordPress - Reverse Shell An extended version of Chocapikk's CVE-2023-6553 exploit that adds a one-command reverse shell mode on top of the original interactive webshell. Vulnerability CVE-2023-6553 — Unauthenticated Remote Code Execution in the...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Unauthenticated Subscriber+ Arbitrary Options Update Description The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function...

CVE-2025-11986

1 Extract the public cryptoajax nonce from the restricted page UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' NONCE=$curl -s "http://localhost/wordpress/" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

sudowp-adminer

SudoWP Adminer Security Fork Contributors: SudoWP, WP Republic Original Authors: Frank Bültge, Inpsyde Tags: adminer, database, security, cve-2021-21311, ssrf-patch Requires at least: 5.8 Tested up to: 6.7 Stable tag: 1.5.0 License: GPLv2 or later Security Notice CVE-2021-21311 This is a...

UPGer

UPGer | CVE-2022-4060 - User Post Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4060 - WordPress Plugin : User Post Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use bash upger.sh yourlist.txt thread...

CVE-2022-1119

CVE-2022-1119 1.Introduction WordPress Simple File List 3.2.8 FileRead POC 2.Usage poc -f host.txt // Batch scan poc -h 192.168.1.1 // Single scan 3.Disclaimer This tool is only for learning, research, and self-assessment. It should not be used for illegal purposes. Please comply with relevant la...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2025-29009-POC

CVE-2025-29009-POC Medical Prescription Attachment Plugin for WooCommerce = 1.2.3 - Unauthenticated Arbitrary File Upload. Watch demo here: https://youtu.be/WvW2shDBIFs...

CVE-2023-5360

CVE-2023-5360 Elementor File Upload Exploit The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. / / | / / / / / | | / / / / / | |/ /// /...

zeek-plugin-roca

Johanna::ROCA This plugin implements detection of CVE-2017-15361 keys; it is a reimplementation of the source available at https://github.com/crocs-muni/roca. This plugin provides two new BIFs that can check public keys: rocavulnerablecert checks if a certificate is vulnerable rocavulnerablemod...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CredMaster

CredMaster Launch a password spray / brute force attach via Amazon AWS passthrough proxies, shifting the requesting IP address for every authentication attempt. This dynamically creates FireProx APIs for more evasive password sprays. Shoutout to @ustayready for his CredKing and FireProx tools,...

CVE-2024-0235-PoC

CVE-2024-0235-PoC The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog Usage: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py: error:...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - Arbitrary File Upload Vulnerability CVE-2025-7441 - Technical summary Affected component: StoryChief WordPress plugin Vulnerability type: Unauthenticated arbitrary file upload Vulnerable endpoint: /wp-json/storychief/webhook Root cause: The plugin accepts a JSON...

exploit_cve-2023-26326_using_cve-2024-2961

Exploit BuddyForms CVE-2023-26326 using Iconv CVE-2024-2961 This work was done by me, Omar Elshopky, and Nour El Dien Bassiouny. This repository contains an exploit for the WordPress BuddyForms Plugin CVE-2023-26326, initially reported in the advisory by Joshua Martinelle. The exploit leverages a...

serverless

Website • Documentation • X / Twitter • Community Slack • Forum The Serverless Framework – Makes it easy to use AWS Lambda and other managed cloud services to build applications that auto-scale, cost nothing when idle, and result in radically low maintenance. The Serverless Framework is a...