wp2shell-poc

wp2shell-poc Prueba de concepto independiente para la inyección SQL por confusión de rutas en el lote REST de WordPress sin autenticación, asociada al aviso wp2shell de Searchlight Cyber. Este repositorio no es el verificador oficial de Searchlight Cyber. check confirma la ruta del SQLi, read...

CVE-2026-63030

CVE-2026-63030 PoC de cadena de explotación completa en WordPress REST API: confusión de rutas batch + inyección SQL que conducen a creación de administrador sin autenticación → ejecución remota de código. Solo para pruebas de seguridad autorizadas, reproducción de vulnerabilidades e investigació...

wp2shell-lab

mini-wp-rest Una reimplementación compacta y sin dependencias de una pequeña parte de la API REST de WordPress — lo justo para servir una colección pública de entradas y ejecutar varias subpeticiones en un solo viaje de ida y vuelta. Útil para enseñar cómo encajan el enrutamiento de WordPress,...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — Prueba de concepto de SQLi ciega basada en tiempo en WordPress REST API → RCE Descripción pocwptot.py es una prueba de concepto PoC para explotar la vulnerabilidad de inyección SQL ciega basada en tiempo en el endpoint batch de la WordPress REST API y realizar una cadena de escalada...

CVE-2026-80099

CVE-2026-80099 PoC Bypass de autenticación no autenticado y exploit de RCE dirigido a plugins de WordPress de Newfold que incluyen wp-module-data. Descripción general Esta herramienta explota un fallo de validación de token Bearer en el módulo wp-module-data de Newfold. Cuando un sitio de WordPre...

EUVD-2025-210644

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

Exploit for CVE-2026-63030

CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...

CVE-2026-15103

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the updatesettings REST callback failing to validate the groupid path...

CVE-2026-12126

CVE-2026-12126 affects the WCFM Marketplace plugin for WordPress (versions

CVE-2026-15335 Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15286

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'getitemspermissioncheck' function permission callback of the...

PT-2026-57063

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get items permission check' function permission callback of the...

CVE-2026-4275

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of 'returntrue' as the permissioncallback for the /installplugin and /activateplugin REST API endpoint...

EUVD-2026-42563

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of 'returntrue' as the permissioncallback for the /installplugin and /activateplugin REST API endpoint...

CVE-2026-4275

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of 'returntrue' as the permissioncallback for the /installplugin and /activateplugin REST API endpoint...

CVE-2026-12433 Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/id REST endpoint. This is due to the getBookingDetails callback only...

CVE-2026-13468

The CVE-2026-13468 affects the WordPress plugin Visualizer – Tables & Charts Manager with Built-in AI Generator, vulnerable in all versions up to 4.0.3. The root cause is missing authorization checks for actions on the plugin’s REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/, allowing...

PT-2026-54474

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-9013 Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogorestcreateposttranslation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt,...