CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / 漏洞利用脚本： CVE-2026-2631.py 作者： Khaled Alenazi Nxploited – Nxploited ZeroDay Hub 联系方式： Telegram：@Kxploit 🧬 漏洞概述 插件： Datalogics Ecommerce Delivery – Datalogics WordPress 受影响版本： 2.6.60（不含） 漏洞类型： 未认证权限提升 CVE： CVE-2026-2631 CVSS v3.1： 9.8...

amasty-chekout-POC-rce

CVE-2026-53787 - Amasty Order Attributes 未认证文件上传 描述 CVE-2026-53787 是 Amasty Order Attributes 扩展中一个严重的未认证任意文件上传漏洞，影响 Magento 2 早于 4.0.0 的版本。该漏洞允许攻击者将任意类型或名称的文件上传到商店的媒体目录，而无需身份验证、会话验证或购物车上下文。 影响 该攻击无需凭据，可通过网络执行。该漏洞的 CVSS 评分为 9.8（严重）。成功利用可能导致： 如果媒体目录允许执行 PHP，则可实现远程代码执行（RCE），使攻击者完全控制服务器 利用受信任域名托管恶意软件...

cve-2022-1388-iveresk-command-shell

CVE-2022-1388 由 1vere$k 提供，带命令 shell 针对影响多个F5产品的CVE-2022-1388改进版PoC。 这是Horizon3针对CVE-2022-1388的PoC的改进版本：https://github.com/horizon3ai/CVE-2022-1388 同时，这也是一次完全的重构，基于 PsychoSec 的工作：https://github.com/PsychoSec2/CVE-2022-1388-POC 哈，这家伙在Requirements部分提到了诸如brains这样的要点，并且代码有超过40%的重复且完全不可扩展。...

CVE-2022-47615

CVE-2022-47615 LearnPress プラグイン 4.2.0 - 認証なし LFI 脆弱性の説明 説明 このプラグインは、lp/v1/courses/archive-course REST エンドポイントで様々なパラメータを適切に検証せずに include 文で使用しているため、LFI 問題が発生する可能性があります。 使用方法 root@kitploit: $ python3 exploit.py -u http://wordpress.lan -f ../../../etc/passwd root:x:0:0:root:/root:/bin/bash...

wp2shell-scanner

wp2shell-scanner Herramientas de detección y validación para la exposición del núcleo de WordPress a wp2shell CVE-2026-63030 / CVE-2026-60137. Los modos se seleccionan con una bandera, y el objetivo es posicional. --scan toma la huella de la versión del núcleo y confirma que la ruta REST /batch/v...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - 未授权的任意选项更新 描述 该插件在通过 REST 端点更新选项时缺乏授权和 CSRF 检查，并且未确保要更新的选项属于该插件。因此，未认证的攻击者可以更改任意博客选项，例如 userscanregister 和 defaultrole，从而允许他们创建新的管理员账户并接管博客。 示例：启用管理员与注册 root@kitploit: $ python3 CVE-2022-0952.py -u http://192.168.1.131:5555 The plugin version is below...

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

WPAdverts <= 2.3.2 - Information Disclosure

WPAdverts – Classifieds Plugin for WordPress = 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication. id:...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...

WP-Bricks-Exploit-CVE-2024-25600

BricksRCE Exploiter（ブリックスRCEエクスプロイター） CVE-2024-25600 — WordPress Bricks Builder の非認証リモートコード実行脆弱性 CVE-2024-25600 のための認可されたセキュリティ評価ツール 作成者: Sudeepa Wanigarathna · ツール: BricksRCE Exploiter v1.0 メインスクリプト: cve-2024-25600.py !IMPORTANT 認可された使用のみ。...

CVE-2026-63030-wp2r00t

wp2r00t - PoC de Inyección SQL Ciega por Confusión de Rutas en el Endpoint Batch de WordPress Una prueba de concepto autónoma para la inyección SQL ciega no autenticada alcanzable a través del endpoint batch REST de WordPress /wp-json/batch/v1. Es una implementación independiente construida a...

PT-2026-86767

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability discovered by Applied Cybernetics in WordPress Plugin LearnDash LMS versions 4.25.0-5.1.6...

CVE-2026-83543 Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...