CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE | ---|--- Plugin| Divi Ajax Filter Divi Engine, premium — bukan di wordpress.org SVN Affected| semua versi = 5.1.2 lab memakai 3.1.8.4 dari mirror Patched| 5.1.3 11/08/2026 Tipe| CWE-98 — PHP Local File Inclusion, unauthenticated CVSS| 9.8 Critical...

CVE-2026-63030

Wordpress Core / SQLi 6.9.0 - 6.9.4 7.0.0 - 7.0.1 PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7

CVE-2021-29447 Authenticated XXE Exploit for WordPress 🎯 A Python PoC to exploit the authenticated XXE vulnerability CVE-2021-29447 in WordPress versions 5.6–5.7 via WAV metadata. It abuses the iXML chunk in WAV files to trigger an Out-of-Band OOB exfiltration of sensitive data—like /etc/passwd,...

base-wordpress

BASE-WORDPRESS This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/base-wordpress Image based on: https://github.com/Medicean/VulApps/tree/master/base/wordpress...

Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

Reconnaissance and Exploitation: Apache HTTP Server Vulnerabilities - CVE-2021-41773 and CVE-2021-42013 In this project, I documented a detailed penetration testing process targeting Apache HTTP Server vulnerabilities, specifically CVE-2021-41773 and CVE-2021-42013, which involve Path Traversal a...

wp2shell-scan

wp2shell-scan Detect and clean upwp2shell CVE‑2026‑63030 compromise across one or many WordPress sites. wp2shell is the pre‑authentication remote‑code‑execution vulnerability fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. A public PoC appeared within a day and mass‑exploitation followed...

CVE-2026-60137

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast, menu-driven database extraction tool exploiting the authornotin SQL injection vulnerability in WordPress core. This tool focuses purely on database enumeration and dumping, utilizing the REST batch route confusion CVE-2026-63030 to reach th...

wp2shell-detect

wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE Exploitation & Mitigation CVE-2020-25213 📌 Project Overview This project was developed as part of the IE4012 – Offensive Hacking Tactics & Strategies module. It demonstrates a full cybersecurity attack lifecycle in a controlled lab environment, including: Social engineering attack...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

CVE-2023-6553

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup Migration Plugin Plugin: Backup Migration backup-backup ≤ 1.3.7 CVSS: 9.8 Critical CWE: CWE-98 — Improper Control of Filename for Include/Require Statement Authentication Requirement: None Impact: Remote Code Execution 1. What is this...

CVE-2025-2011

CVE-2025-2011 PoC By: X3RX3S But Proudly ripped by Ash Wesker that GPT'd my code with his banner ; see here --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 You can even see my handle in 'his' code --' Purpose: A proof-of-concept tool to test for an SQL injection vulnerability CVE-2025-201...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...

sudowp-adminer

SudoWP Adminer Security Fork Contributors: SudoWP, WP Republic Original Authors: Frank Bültge, Inpsyde Tags: adminer, database, security, cve-2021-21311, ssrf-patch Requires at least: 5.8 Tested up to: 6.7 Stable tag: 1.5.0 License: GPLv2 or later Security Notice CVE-2021-21311 This is a...

CVE-2025-15521

CVE-2025-15521 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. | | | | || | | | || | | | | | | | --| | | || | | | | ||| || | | || | ||/|| ||||| |||||...