CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...

CVE-2026-93549

The CoCart WordPress plugin, in versions 4.9.0 through 4.9.6 , contains a vulnerability where it fails to scope its REST API authentication filter to its specific endpoints. This oversight disables the WordPress core REST nonce protection across all routes. An attacker can exploit this flaw to pe...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

OptinMonster Plugin < 2.6.5 - Unprotected REST-API

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

PT-2026-104605

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-93549: Undefined Security Weakness

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

CVE-2026-104118: Undefined Security Weakness

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2026-100903

CVE-2026-100903 GEOritm Missing Authentication Description : A vulnerability in the POST /restapi/objects/obj-groups method of the GEO.RITM software REST API is related to a lack of authentication before executing the function. Impact : Exploitation of this vulnerability could allow an attacker...

vt-go

vt-go This is the official Go client library for VirusTotal. With this library you can interact with the VirusTotal REST API v3 without having to send plain HTTP requests with the standard "http" package. Usage example package main import "flag" "fmt" "log" "os" vt "github.com/VirusTotal/vt-go" v...

vt-py

vt-py This is the official Python client library for VirusTotal. With this library you can interact with the VirusTotal REST API v3 and automate your workflow quickly and efficiently. Things you can do with vt-py Scan files and URLs Get information about files, URLs, domains, etc Perform VirusTot...

cve-2017-5487

What is CVE-2017-5487? : A vulnerability in the REST API implementation in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in WordPress versions prior to 4.7.1 that does not restrict the list of authors, allowing remote attackers to obtain sensitive information via a...

CVE-2025-32682

🐚 CVE-2025-32682 - Arbitrary File Upload in MapSVG Lite = 8.5.34 📌 Plugin Details Name: MapSVG Lite Affected Version: = 8.5.34 Vulnerability Type: Arbitrary File Upload CVE ID: CVE-2025-32682 Published Date: 15 April, 2025 CVSS Score: 9.9 Critical 💥 Vulnerability Summary The MapSVG Lite plugin fo...

CVE-2024-11972-POC

Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site default: http://localhost/wordpress/. -p PLUGIN, --plugin PLUGIN Plugin na...

CVE-2026-27344

Broken Access Control in Inseri Core WordPress Plugin Plugin: Inseri Core Affected Component: /includes/restapi.php Vulnerability Type: Broken Access Control Missing Authorization Status: Reported in August 2026– Closed as Duplicate. Summary Whilst testing this summer I came across a Broken Acces...

CVE-2026-48907

CVE-2026-48907 Description This file CVE-2025-9209.py is a mass exploitation tool targeting vulnerability CVE-2025-9209. Core functionalities: Scans a list of sites by calling /wp-json/wp/v2/users Analyzes the response to look for sensitive user data such as public and private keys, tokens, and...