Admin-Takeover

Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389) new EPSS 76%CVE-2025-6389webCRITICAL 9.8Unverified2026-07-06Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342) newCVE-2025-13342webCRITICAL 9.8Patched2026-07-06WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791) newCVE-2026-40791webHIGH 7.2Patched2026-07-05WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807 newCVE-2026-54807webINFOUnverified2026-07-05User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492) new EPSS 24%CVE-2026-1492webCRITICAL 9.8Unverified2026-07-05UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795) newCVE-2026-10795webCRITICALUnverified2026-07-05LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920) newCVE-2026-0920webCRITICAL 9.8Unverified2026-07-05Divi Form Builder <= 5.1.2 Unauthenticated Privilege Escalation via Role Injection (CVE-2026-5118) newCVE-2026-5118webCRITICAL 9.8Unverified2026-07-05AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729 newCVE-2026-1729webCRITICALUnverified2026-07-05Gogs Admin User Edit CSRF to Git Hook RCE newNone assigned as of 2026-07-03webCRITICALUnverified2026-07-03