CVE-2026-12514

The Shared Files WordPress plugin (before 1.7.67 ) and shared-files-pro (before 1.7.70 ) lack a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce rendered on public pages. An unauthenticated visitor can therefore upload file...

EUVD-2026-67567

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-14558

CVE-2026-14558 affects the WP User Frontend WordPress plugin prior to 4.3.10 . The flaw lies in the AI Form Builder component, which does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts. Users with Editor-level access (or ...

CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

EUVD-2026-67565

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

CVE-2026-12513 Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 - Autorizzazione mancante per aggiornamento arbitrario delle opzioni senza autenticazione Descrizione Il plugin Agency Toolkit per WordPress è vulnerabile alla modifica non autorizzata dei dati che può portare a un'escalation dei privilegi a causa della mancanza di u...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Injeção de Objeto PHP Autenticada Assinante+ Descrição O plugin ARPrice para WordPress é vulnerável a Injeção de Objeto PHP nas versões até, e incluindo, 4.0.3, por meio da desserialização de entrada não confiável. Isso possibilita que atacantes autenticados, com...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE Ausnutzung & Eindämmung CVE-2020-25213 📌 Projektübersicht Dieses Projekt wurde im Rahmen des Moduls IE4012 – Offensive Hacking Tactics & Strategies entwickelt. Es demonstriert einen vollständigen Cybersicherheitsangriffslebenszyklus in einer kontrollierten Laborumgebung,...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — Escalation dei Privilegi Non Autenticata Automazione dell'Exploit in 8 Fasi | Multiprocessing + Asyncio | Creazione Admin Verificata 🎯 Informazioni sulla Vulnerabilità Il plugin WordPress WP Maps Pro versione ≤ 6.1.0 presenta una vulnerabilità di escalation...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — Unauthenticated RCE via calluserfunc ohne Allowlist Zusammenfassung der Schwachstelle Schwachstelle Remote Code Execution RCE ohne Authentifizierung im Plugin Avada Builder Fusion Builder Version = 3.15.2, verwendet im WordPress-Theme Avada — einem der...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Um campo oculto. Um valor alterado. Acesso total a todo o site. 🧨 O que o Atacante Pode Fazer? 🔬 Análise da Vulnerabilidade Localização da Vulnerabilidade root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Código Vulnerável...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion O plugin não impede que atacantes não autenticados sobrescrevam variáveis locais ao renderizar templates pela API REST, o que pode levar a ataques de Inclusão de Arquivo Local. Uso: root@kitploit: usage: PoC.py -h -u URL -p PAYLOAD...

Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

3DPrint-Lite-1.9.1.4

3DPrint-Lite-1.9.1.4 Plugin WordPress 3DPrint Lite 1.9.1.4 - Caricamento file arbitrario...

wp-file-manager

wp-file-manager WP File Manager 6.9 - Caricamento arbitrario di file che porta a RCE root@kitploit: usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File o...

wordpress-php-object-helper

wordpress-php-object-helper Informazioni Hai un plugin noto con un exploit di oggetti PHP?, ma devi determinare quale libreria usare per sfruttare il problema ed eseguire con phpggc. Questo dovrebbe aiutarti. Output di esempio root@kitploit: $ python3 finder.py -u http://wordpress.lan -f...

CVE-2025-2011-poc

WordPress Depicter Plugin 3.6.1 - SQL Injection root@kitploit: usage: exploit.py -h -u URL -D DATABASE -T TABLE -C COLUMN...

wordpress-bf

wordpress-bf Dies ist ein Tool, um die Autoren einer WordPress-Blog-Website zu enumerieren und zu versuchen, die Logins per Brute-Force zu knacken. Es ist nicht vollständig, funktioniert aber. Wenn du schrecklichen Code entdeckst, reiche bitte einen PR ein, um ihn zu beheben! Es schreibt die URL...