tag
Admin-Takeover
Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389)
The Sneeit Framework plugin for WordPress registers an unauthenticated AJAX action, sneeitarticlespagination, whose callback function sneeitarticlespaginationcallback() takes a function name and a JSON-encoded argument list straight from $POST['callback'] and…
Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342)
CVE-2025-13342 is a critical, fully unauthenticated privilege-escalation vulnerability in the Frontend Admin plugin for WordPress (<= 3.28.20). The plugin's ACF-powered frontend registration/form-submission handler accepts user-controlled acff[user][field]…
WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)
The public booking form of the WP Time Slots Booking Form plugin parses a submitted appointment field by splitting on a literal space character, then stores the resulting substring as the booking's time-slot value. Because HTML treats a tab character as valid…
WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807
The vulnerable plugin's frontend user-registration form accepts a userroles parameter directly from the unauthenticated registration POST request and trusts it when creating the new WordPress account, instead of forcing a safe default role (e.g. subscriber or…
User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492)
The plugin's userregistrationmembershipregistermember AJAX handler accepts a client-supplied role field inside the membersdata JSON payload during membership registration, without enforcing a server-side allowlist or capability check. An unauthenticated…
UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)
UpdraftPlus ships a remote-management RPC channel (UpdraftCentral) reachable via admin-ajax.php that authenticates requests using an AES-encrypted message keyed to one of several well-known "keyname" identifiers (e.g. migrator.updraftplus.com). When a site…
LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)
LA-Studio Element Kit for Elementor registers an unauthenticated AJAX action (wpajaxnoprivlakitajax) that handles front-end user registration requests. The handler builds a wpinsertuser() call directly from attacker-supplied POST data, including a lakitbkrole…
Divi Form Builder <= 5.1.2 Unauthenticated Privilege Escalation via Role Injection (CVE-2026-5118)
Divi Form Builder <= 5.1.2's createuser() logic (in FormSubmissionHandler.php) reads a role value directly from submitted form POST data and only checks that the role exists in WordPress (e.g. administrator is a valid role name) rather than checking that it…
AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729
The AdForest WordPress theme implements a one-time-password (OTP) login flow via the sbloginuserwithotpfun AJAX handler, but the handler does not actually verify the submitted OTP code against a server-issued value before authenticating the requested user. As…
Gogs Admin User Edit CSRF to Git Hook RCE
Gogs' admin user-edit route (POST /admin/users/:userid) performs the state-changing grant of IsAdmin/AllowGitHook without a CSRF token, so an authenticated site administrator can be induced (e.g., via a cross-site form submission) to grant those rights to an…