PoC-CVE-2022-4939-

PoC-CVE-2022-4939 The attacker sends a specially crafted request to the wpajaxnoprivwcfmajaxcontroller AJAX action to modify the membership registration form and set the registration role to that of an administrator. Then, the plugin processes the request and modifies the membership registration...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form PRİV8 TOOLS AND EXPLOİT CANAL: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...

CVE-2026-15989

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...

CVE-2026-75823

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

EUVD-2026-89639

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Un champ caché. Une valeur modifiée. Accès complet à l'ensemble du site. 🧨 Que peut faire un attaquant ? Capacité| Impact ---|--- 🔑 Créer un compte admin sans connexion| Prise de contrôle totale du site 📦 Accéder aux données client WooCommerce| Fuite de données 💉...

CVE-2025-2005

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 This repository provides a Proof of Concept PoC exploit for the WordPress Front End Users plugin versions up to 3.2.32, which is vulnerable to arbitrary file upload due to missing MIME/file-type validation in its registration form.This...

CVE-2025-6934

🛡️ CVE-2025-6934 - Élévation de privilèges non authentifiée dans Opal Estate Pro 📝 Description Le plugin Opal Estate Pro – Property Management and Submission pour WordPress, utilisé par le thème FullHouse - Real Estate Responsive WordPress Theme , est vulnérable à une élévation de privilèges dans...

CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

PT-2026-95924

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.2.1 Description An issue exists where role validation is not applied when a registration form is nested within an imported quiz. This allows a user with permissions to import quizzes to publish a publicl...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin, in versions before 1.1.3 (specifically 1.1.0-1.1.2), is vulnerable to a privilege escalation attack. The plugin fails to validate whether a referenced registration form is legitimate, instead reading the permitted-role allow-list from an arb...