PoC-CVE-2022-4939-

PoC-CVE-2022-4939 El atacante envía una solicitud especialmente manipulada a la acción AJAX wpajaxnoprivwcfmajaxcontroller para modificar el formulario de registro de membresía y establecer el rol de registro al de administrador. Luego, el plugin procesa la solicitud y modifica el formulario de...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 Escalada de Privilegios en WooCommerce ║ ║ Asignación de Rol de Administrador no Autenticada a través del Formulario de Registro CANAL DE HERRAMIENTAS Y EXPLOITS PRIV8: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Escalada de Privilegios sin Autenticación Autor: Hyun Chiya Información de la Vulnerabilidad Campo| Valor ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Versiones Afectadas| B"Extract Nonce acfnonce & Form ID acfform" B --...

CVE-2026-15989

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...

CVE-2026-75823

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

EUVD-2026-89639

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Un campo oculto. Un valor modificado. Acceso completo a todo el sitio web. 🧨 ¿Qué puede hacer el atacante? Capacidad| Impacto ---|--- 🔑 Crear cuenta de admin sin inicio de sesión| Full Site Takeover 📦 Acceder a datos de clientes de WooCommerce| Data Breach 💉 Edit...

CVE-2025-2005

Exploit de Subida Arbitraria de Archivos en WordPress FEUP CVE-2025-2005 Este repositorio proporciona un exploit de Prueba de Concepto PoC para el plugin Front End Users de WordPress versiones hasta 3.2.32, el cual es vulnerable a subida arbitraria de archivos debido a la falta de validación de...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

PT-2026-95924

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.2.1 Description An issue exists where role validation is not applied when a registration form is nested within an imported quiz. This allows a user with permissions to import quizzes to publish a publicl...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

PT-2026-95263

Name of the Vulnerable Software and Affected Versions Clean Login WordPress plugin versions prior to 1.19 Description The plugin fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass anti-automation controls on the registratio...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin, in versions before 1.1.3 (specifically 1.1.0-1.1.2), is vulnerable to a privilege escalation attack. The plugin fails to validate whether a referenced registration form is legitimate, instead reading the permitted-role allow-list from an arb...