https://poc.intelseclab.com/tags/admin-ajax/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-11170. Status: Weaponized. Affects: WP移行専用プラグイン for CPI (cpi-wp-migration, a CPI/site-migration import plugin for WordPress). Tags: wordpress, cpi-wp-migration, unauthenticated-file-upload, rce, admin-ajax, cwe-434, python.webCriticalwordpresscpi-wp-migrationunauthenticated-file-uploadrceadmin-ajaxcwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-4334. Status: PoC. Affects: "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action). Tags: wordpress, wp-plugin, simple-user-registration, privilege-escalation, unauthenticated, admin-ajax, cwe-269, python.webCriticalwordpresswp-pluginsimple-user-registrationprivilege-escalationunauthenticatedadmin-ajaxcwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-6758. Status: Weaponized. Affects: Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler). Tags: wordpress, real-spaces, imic, privilege-escalation, unauthenticated, admin-ajax, role-assignment, cwe-269, cwe-863, python.webCriticalwordpressreal-spacesimicprivilege-escalationunauthenticatedadmin-ajaxrole-assignmentcwe-269cwe-863pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Critical severity (CVSS 9.8) — web · CVE-2025-6934. Status: Weaponized. Affects: Opal Estate Pro (WordPress real-estate plugin). Tags: wordpress, opal-estate-pro, privilege-escalation, unauthenticated-registration, admin-ajax, nonce-abuse, cwe-269, python.webCriticalwordpressopal-estate-proprivilege-escalationunauthenticated-registrationadmin-ajaxnonce-abusecwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Medium severity — web · CVE-2026-0745 (GHSA-m38c-5p3m-p7gm). Status: PoC. Affects: WordPress "User Language Switch" plugin. Tags: wordpress, ssrf, plugin-vulnerability, admin-ajax, cwe-918, metadata-endpoint.webMediumwordpressssrfplugin-vulnerabilityadmin-ajaxcwe-918metadata-endpointhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/High severity — web · CVE-2026-0740. Status: PoC. Affects: WordPress "Ninja Forms" plugin — file upload field/module. Tags: wordpress, ninja-forms, file-upload, webshell, admin-ajax, plugin-vulnerability, cwe-434.webHighwordpressninja-formsfile-uploadwebshelladmin-ajaxplugin-vulnerabilitycwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/High severity — web · CVE-2026-3180. Status: PoC. Affects: WordPress "Contest Gallery" plugin. Tags: wordpress, sqli, blind-sqli, plugin, admin-ajax, unauthenticated, php, boolean-based.webHighwordpresssqliblind-sqlipluginadmin-ajaxunauthenticatedphpboolean-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Critical severity — web · CVE-2026-3359. Status: PoC. Affects: WordPress "Form Maker" plugin by Web10. Tags: wordpress, sql-injection, form-maker, unauthenticated, admin-ajax, wp-plugin, data-exfiltration.webCriticalwordpresssql-injectionform-makerunauthenticatedadmin-ajaxwp-plugindata-exfiltrationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/High severity (CVSS 8.1) — web · CVE-2026-5364. Status: PoC. Affects: WordPress plugin "Drag and Drop File Upload for Contact Form 7" (drag-and-drop-file-upload-for-contact-form-7). Tags: wordpress, contact-form-7, file-upload, webshell, rce, sanitize-file-name-bypass, admin-ajax, cwe-434.webHighwordpresscontact-form-7file-uploadwebshellrcesanitize-file-name-bypassadmin-ajaxcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/High severity (CVSS 8.1) — web · CVE-2026-4350. Status: PoC. Affects: Perfmatters WordPress plugin. Tags: wordpress, plugin, perfmatters, path-traversal, arbitrary-file-deletion, admin-ajax, dos, nuclei.webHighwordpresspluginperfmatterspath-traversalarbitrary-file-deletionadmin-ajaxdosnucleihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4406-gravity-forms-reflected-xss/Medium severity (CVSS 6.1) — web · CVE-2026-4406. Status: PoC. Affects: Gravity Forms (WordPress plugin) by Rocketgenius, Inc.. Tags: wordpress, gravity-forms, xss, reflected-xss, admin-ajax, unauthenticated, cwe-79.webMediumwordpressgravity-formsxssreflected-xssadmin-ajaxunauthenticatedcwe-79https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7515-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7515-poc/Critical severity (CVSS 9.8) — web · CVE-2026-7515. Status: PoC. Affects: BetterDocs Pro (WordPress plugin). Tags: wordpress, betterdocs-pro, lfi, path-traversal, log-poisoning, rce, cwe-98, admin-ajax.webCriticalwordpressbetterdocs-prolfipath-traversallog-poisoningrcecwe-98admin-ajax