EUVD-2026-92072

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-93549

The CoCart WordPress plugin, in versions 4.9.0 through 4.9.6 , contains a vulnerability where it fails to scope its REST API authentication filter to its specific endpoints. This oversight disables the WordPress core REST nonce protection across all routes. An attacker can exploit this flaw to pe...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security 在 Docker 中的身份验证绕过漏洞 描述 WordPress 的 Really Simple Security 插件（Free、Pro 和 Pro Multisite）版本 9.0.0 到 9.1.1.1 受到一个身份验证绕过漏洞的影响。 此问题源于用于双因素 REST API 操作的 checkloginandgetuser 函数中的不当错误处理。 因此，如果启用了“双因素身份验证”功能（默认禁用），未经身份验证的攻击者可能以任何现有用户（包括管理员）的身份登录。 受影响 Docke...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

OptinMonster Plugin < 2.6.5 - Unprotected REST-API

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

PT-2026-104605

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-93549: Undefined Security Weakness

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

CVE-2026-104118: Undefined Security Weakness

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API 时间盲SQL注入 → RCE 概念验证 描述 pocwptot.py 是一个概念验证（PoC），用于利用 WordPress REST API 批量端点上的时间盲SQL注入漏洞，并通过链式升级实现远程代码执行（RCE）。 被测试的漏洞： CVE-2026-63030 CVE-2026-60137 重要警告 仅将此工具用于您拥有或拥有明确书面许可进行测试的系统。滥用可能导致非法和破坏性后果。 作者：GhostGTR666 github.com/gagaltotal PoC 版本：1.0.0 要求 Python 3.8+（推荐）...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2026-100903

CVE-2026-100903 GEOritm Autenticación Faltante Descripción : Una vulnerabilidad en el método POST /restapi/objects/obj-groups de la API REST del software GEO.RITM está relacionada con la falta de autenticación antes de ejecutar la función. Impacto : La explotación de esta vulnerabilidad podría...

vt-go

vt-go Esta es la biblioteca cliente oficial de Go para VirusTotal. Con esta biblioteca puedes interactuar con la API REST v3 de VirusTotal sin tener que enviar solicitudes HTTP simples con el paquete estándar "http". Ejemplo de uso package main import "flag" "fmt" "log" "os" vt...

vt-py

vt-py Esta es la biblioteca oficial de cliente de Python para VirusTotal. Con esta biblioteca puedes interactuar con la API REST v3 de VirusTotal y automatizar tu flujo de trabajo de forma rápida y eficiente. Cosas que puedes hacer con vt-py Analizar archivos y URL Obtener información sobre...

cve-2017-5487

CVE-2017-5487是什么？ : WordPress 4.7.1之前的版本中，wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php的REST API实现未限制发布者列表，导致远程攻击者可通过wp-json/wp/v2/users请求获取敏感信息的漏洞。 （参考：https://vulners.com/cve/CVE-2017-5487） 如果不知道是什么意思，先了解背景知识，再通过实践来学习。 如果觉得不需要背景知识，可以直接看3。 2. REST API是什么？ :...

CVE-2025-32682

🐚 CVE-2025-32682 - Subida Arbitraria de Archivos en MapSVG Lite = 8.5.34 📌 Detalles del Plugin Nombre: MapSVG Lite Versión Afectada: = 8.5.34 Tipo de Vulnerabilidad: Subida Arbitraria de Archivos ID de CVE: CVE-2025-32682 Fecha de Publicación: 15 de abril de 2025 Puntuación CVSS: 9.9 Crítica 💥...

CVE-2024-11972-POC

描述 名称 : CVE-2024-11972 CVSSv3 分数 : 9.8 受影响版本 : Hunk Companion argparse，requests，urljoin 用法 options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site default: http://localhost/wordpress/. -p PLUGIN, --plugin PLUGIN Plugin name to install default:...

CVE-2026-27344

Control de acceso roto en Inseri Core plugin de WordPress Plugin: Inseri Core Componente afectado: /includes/restapi.php Tipo de vulnerabilidad: Control de acceso roto Falta de autorización Estado: Reportada en agosto de 2026– cerrada como Duplicada. Resumen Mientras realizaba pruebas este verano...

CVE-2026-48907

CVE-2026-48907 Description 文件 CVE-2025-9209.py 是一个批量利用工具，针对 CVE-2025-9209 漏洞。 基本功能： 通过调用 /wp-json/wp/v2/users 扫描站点列表 分析响应以查找敏感用户数据，如公钥和私钥、令牌、Cookie 数据 忽略受 Defender/Imunify360 保护的站点 将结果记录到文件：exposures.txt, tokens.txt, cookies.txt, exploitedsites.txt 支持多线程运行，并通过请求间简单延迟避免封锁 此外，在文件开头、横幅和摘要末尾添加了签名...