Call_user_func — PoC Archivehttps://poc.intelseclab.com/tags/call_user_func/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Critical severity (CVSS 9.8) — web · CVE-2025-6389. Status: Weaponized. Affects: Sneeit Framework (WordPress theme framework plugin, sneeit-framework). Tags: wordpress, sneeit-framework, rce, call_user_func, unauthenticated, wp_insert_user, privilege-escalation, admin-takeover, cwe-94, wp-ajax-nopriv.webCriticalwordpresssneeit-frameworkrcecall_user_funcunauthenticatedwp_insert_userprivilege-escalationadmin-takeovercwe-94wp-ajax-noprivAvada Builder Unauthenticated RCE via call_user_func() Allowlist Bypass (CVE-2026-6279)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6279-avada-builder-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6279-avada-builder-rce/Critical severity — web · CVE-2026-6279. Status: Weaponized. Affects: Avada Builder (Fusion Builder) WordPress theme/plugin. Tags: wordpress, avada, fusion-builder, rce, call_user_func, unauthenticated, cwe-94.webCriticalwordpressavadafusion-builderrcecall_user_funcunauthenticatedcwe-94