CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - 未经身份验证的媒体文件上传 描述 User Profile Builder WordPress插件在3.11.8版本之前缺乏适当的授权，允许未经身份验证的用户通过WP的异步上传功能上传媒体文件。 使用方法： usage: CVE-2024-6366.py -h -u URL The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing...

CVE-2026-12684 Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

WordPress Schema & Structured Data for WP & AMP plugin < 1.60 - Unauthenticated Arbitrary Media Upload vulnerability

Unauthenticated Arbitrary Media Upload vulnerability discovered by 0xBassia in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.60...

CVE-2025-13381: Missing Authorization

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ayschatgptsavewpmedia' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload...

WordPress Funnelforms Free plugin <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload and Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Media Upload and Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Funnelforms Free versions = 3.7.3.2...