Admin-Account-Creation — PoC Archivehttps://poc.intelseclab.com/tags/admin-account-creation/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000FortiWeb `cgi-bin/fwbcgi` Path Traversal Authentication Bypass Leading to Rogue Admin Creation (CVE-2025-64446)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-64446. Status: PoC. Affects: Fortinet FortiWeb (Web Application Firewall appliance). Tags: fortiweb, fortinet, waf, authentication-bypass, path-traversal, cgiinfo, cwe-22, cwe-288, admin-account-creation, python.networkCriticalfortiwebfortinetwafauthentication-bypasspath-traversalcgiinfocwe-22cwe-288admin-account-creationpythonAI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Critical severity (CVSS 9.8) — web · CVE-2025-11749. Status: Weaponized. Affects: AI Engine plugin for WordPress (mwai). Tags: wordpress, ai-engine, mwai, mcp, rest-api, information-disclosure, privilege-escalation, admin-account-creation, python, mass-scanner.webCriticalwordpressai-enginemwaimcprest-apiinformation-disclosureprivilege-escalationadmin-account-creationpythonmass-scannerACF Extended (ACFE) `prepare_form()` Unauthenticated RCE via Privilege Escalation (CVE-2025-13486)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13486. Status: Weaponized. Affects: Advanced Custom Fields: Extended (ACFE) — WordPress plugin. Tags: wordpress, acf-extended, acfe, call_user_func_array, unauthenticated-rce, privilege-escalation, admin-account-creation, python, cwe-94.webCriticalwordpressacf-extendedacfecall_user_func_arrayunauthenticated-rceprivilege-escalationadmin-account-creationpythoncwe-94