CVE-2026-13598

The RestrictMate WordPress plugin before 1.3.0 fails to restrict the user role supplied during account registration. An unauthenticated attacker can register a new account with the administrator role, immediately obtaining a logged-in admin session and achieving full site takeover . The fix is to...

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

EUVD-2026-64606

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-16149

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-0551

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

PT-2026-79761

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...

CVE-2026-0551

PPWP – Password Protect Pages (WordPress plugin) is vulnerable to PHP Object Injection in all versions up to and including 1.9.18 . The flaw stems from deserialization of untrusted input via the post_protection_roles parameter, exploitable by any authenticated user with Contributor-level access o...

CVE-2026-16149 Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

wp2shell-Exploit-Waf-Bypass

root@kitploit: | \ / / / / / | | /| / / \ / // / / / / / | |/ |/ / // // / / / / / / / |/|/////// ///// WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137 by Venexy M4xSec Nicht authentifizierte Remote-Codeausführung auf WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Behoben in 6.8.6,...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critica vulnerabilità di Unrestricted File Upload in Elementor Pro Potenzialmente in grado di portare a Remote Code Execution RCE ⚠️ Panoramica CVE-2026-32475 è una vulnerabilità critica che interessa Elementor Pro , un plugin...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC de CVE-2026-52715 Proof of Concept educativa de GeoLeak CVE-2026-52715, injeção SQL não autenticada CVSS 9.3 no plugin GEO my WordPress = 4.5.5 para WordPress. Os parâmetros swlatlng e nelatlng dos limites do mapa são interpolados sem saneamento na cláusula WHERE. Laboratório Docker...

CVE-2024-25092

CVE-2024-25092 Exploit Panoramica CVE-2024-25092 è una vulnerabilità ad alta gravità che colpisce il plugin WordPress NextMove Lite versioni = 2.17.0. Questa vulnerabilità consente a un utente con permessi da subscriber o superiori di installare e attivare plugin arbitrari su un sito WordPress a...

CVE-2024-0235-PoC

CVE-2024-0235-PoC EventON WordPress प्लगइन 4.5.5 से पहले, EventON WordPress प्लगइन 2.2.7 से पहले, AJAX क्रिया में प्राधिकरण नहीं है, जिससे अप्रमाणित उपयोगकर्ता ब्लॉग पर किसी भी उपयोगकर्ता के ईमेल पते प्राप्त कर सकते हैं। Usage: root@kitploit: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py:...

CVE-2024-50476

CVE-2024-50476 GRÜN spendino Spendenformular = 1.0.1 - Aggiornamento non autenticato di opzioni arbitrarie Descrizione: Il plugin GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! per WordPress è vulnerabile alla modifica non autorizzata dei dati, che può portare a un escalation dei...

CVE-2025-32140

🚨 CVE-2025-32140 – Exploit WP Remote Thumbnail Caricamento Arbitrario di File 📝 Descrizione CVE-2025-32140 è una vulnerabilità critica nel plugin WP Remote Thumbnail per WordPress. Consente a attaccanti autenticati con permessi di collaboratore o superiori di caricare file arbitrari , come web...

CVE-2024-56264

CVE-2024-56264 Exploit per WordPress ACF City Selector - Caricamento Arbitrario di File CVE-2024-56264 Panoramica Questa repository contiene un exploit per CVE-2024-56264 , una vulnerabilità di Caricamento Arbitrario di File presente nel plugin WordPress ACF City Selector versioni = 1.14.0. Quest...