wp2shell-poc

How does this work at all How this PoC differs from the public wp2shell exploits all pocs weaponize the same two bugs - the REST batch route confusion CVE-2026-63030 and the authornotin SQL injection CVE-2026-60137 - with the same double-nested batch shape. What differs between them is the RCE pa...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Inyección SQL no autenticada El plugin no sanitiza ni escapa un parámetro de una ruta REST antes de usarlo en una sentencia SQL, lo que permite a usuarios no autenticados realizar ataques de inyección SQL script de configuración: 1. git clone...

wp2shell-lab

wp2shell-lab 针对 CVE-2026-63030 + CVE-2026-60137 的教育性 PoC 与实验环境：WordPress 核心中通过 REST 批处理路由混淆实现的不需要认证的 SQL 注入。 由 Adam Kues（Searchlight Cyber / Assetnote）发现。已在 WordPress 6.9.5 / 7.0.2 中修复。 快速开始 root@kitploit: 启动漏洞实验环境 cd docker && ./setup.sh cd .. 检测 python3 -m exploit check http://localhost:8888...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

EUVD-2026-71869

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

PT-2026-86353

🚨 CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress cor...

CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

EUVD-2026-69850

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

CVE-2026-81195

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) lacks an authorization check on the student-courses REST route , allowing unauthenticated attackers to retrieve per-student course enrollment and learning progress data for any registered user. The vulnerability was discovered by Abdu...

CVE-2026-16061

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16061 Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16984

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-16984

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin (also known as WP Legal Pages ) versions before 3.7.1 lack an authorization check on a REST route that returns stored account data. This allows unauthenticated visitors to retrieve ...

CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

EUVD-2026-66271

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...