wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 "wp2shell", a pre-authentication RCE chain in WordPress core REST API batch-route confusion → SQL injection → RCE. Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta full RCE chain; 6.8.0–6.8.5 SQL injection only,...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Overview WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a...

Blackash-CVE-2025-4322

CVE-2025-4322 : Unauthenticated Privilege Escalation via Password Update "Account Takeover 🔥" Description : The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a...

WordPress WP User Manager plugin 2.9-2.9.19 - Unauthenticated Account Creation vulnerability

Unauthenticated Account Creation vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP User Manager versions 2.9-2.9.19...

WordPress EventON - Subscriber plugin <= 1.4.5 - Unauthenticated SQL Injection vulnerability

WordPress EventON - Subscriber plugin = 1.4.5 - Unauthenticated SQL Injection vulnerability discovered by Austin Ginder in WordPress Plugin EventON - Subscriber versions = 1.4.5...

CVE-2026-96903

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...

CVE-2026-93300

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

CVE-2025-1562

CVE-2025-1562 POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124 Safari/537.36...

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

WordPress Easy Property Listings plugin < 3.5.27 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Easy Property Listings versions 3.5.27...

CVE-2026-96903

The Easy Property Listings WordPress plugin, in versions before 3.5.27 , is vulnerable to a sensitive data disclosure flaw. The plugin fails to perform adequate authorisation checks on several of its contact-management read AJAX actions . This oversight allows any authenticated user, even those w...

EUVD-2026-104801

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

WordPress Easy Property Listings plugin < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure vulnerability

Unauthenticated Hidden Listing Details Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Easy Property Listings versions 3.5.28...

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell WordPress REST API Route Confusion → Remote Code Execution A Critical WordPress Core vulnerability enabling REST API route confusion that can be chained with SQL Injection to achieve unauthenticated Remote Code Execution. 📖 Overview CVE-2026-63030 is a Critical...

CVE-2024-4439

Exploit CVE-2024-4439 This Python script demonstrates an exploit for the vulnerability CVE-2024-4439. You can use this script to test a vulnerable WordPress site. Usage Before start git clone https://github.com/soltanali0/CVE-2024-4439.git cd CVE-2024-4439 pip install -r r.txt...

CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITICAL Vulnerability CVE-ID: CVE-2025-32583 Severity: 9.9 CRITICAL CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Description A vulnerability in the PDF 2 Post WordPress plugin developed by termel allows Remote Code Inclusion RCE...