https://poc.intelseclab.com/tags/cwe-269/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-4334. Status: PoC. Affects: "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action). Tags: wordpress, wp-plugin, simple-user-registration, privilege-escalation, unauthenticated, admin-ajax, cwe-269, python.webCriticalwordpresswp-pluginsimple-user-registrationprivilege-escalationunauthenticatedadmin-ajaxcwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-6758. Status: Weaponized. Affects: Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler). Tags: wordpress, real-spaces, imic, privilege-escalation, unauthenticated, admin-ajax, role-assignment, cwe-269, cwe-863, python.webCriticalwordpressreal-spacesimicprivilege-escalationunauthenticatedadmin-ajaxrole-assignmentcwe-269cwe-863pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Critical severity (CVSS 9.8) — web · CVE-2025-6934. Status: Weaponized. Affects: Opal Estate Pro (WordPress real-estate plugin). Tags: wordpress, opal-estate-pro, privilege-escalation, unauthenticated-registration, admin-ajax, nonce-abuse, cwe-269, python.webCriticalwordpressopal-estate-proprivilege-escalationunauthenticated-registrationadmin-ajaxnonce-abusecwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Critical severity (CVSS 9.8) — web · CVE-2025-14156. Status: Weaponized. Affects: Fox LMS (WordPress LMS plugin). Tags: wordpress, fox-lms, rest-api, privilege-escalation, role-injection, unauthenticated, python, cwe-269.webCriticalwordpressfox-lmsrest-apiprivilege-escalationrole-injectionunauthenticatedpythoncwe-269https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Critical severity — web · CVE-2026-3629. Status: PoC. Affects: Import and Export Users and Customers (WordPress plugin). Tags: wordpress, privilege-escalation, plugin, import-export-users, cwe-269.webCriticalwordpressprivilege-escalationpluginimport-export-userscwe-269https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1492-user-registration-membership-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1492-user-registration-membership-privesc/Critical severity (CVSS 9.8) — web · CVE-2026-1492. Status: Weaponized. Affects: User Registration & Membership WordPress plugin (Custom Registration Form Builder, Login Form, User Profile, Content Restriction & Membership). Tags: wordpress, privilege-escalation, unauthenticated, ajax, membership-plugin, admin-takeover, cwe-269.webCriticalwordpressprivilege-escalationunauthenticatedajaxmembership-pluginadmin-takeovercwe-269https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4484-masteriyo-lms-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4484-masteriyo-lms-privesc/High severity (CVSS 8.8) — web · CVE-2026-4484. Status: PoC. Affects: Masteriyo LMS plugin for WordPress. Tags: wordpress, masteriyo-lms, privilege-escalation, rest-api, cwe-269, broken-access-control.webHighwordpressmasteriyo-lmsprivilege-escalationrest-apicwe-269broken-access-controlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6741-latepoint-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6741-latepoint-privesc/High severity (CVSS 8.8) — web · CVE-2026-6741. Status: PoC. Affects: LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin, slug latepoint). Tags: wordpress, latepoint, privilege-escalation, abilities-api, rest-api, account-takeover, cwe-269.webHighwordpresslatepointprivilege-escalationabilities-apirest-apiaccount-takeovercwe-269https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9018-easy-elements-elementor-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9018-easy-elements-elementor-privesc/High severity (CVSS 8.8) — web · CVE-2026-9018. Status: PoC. Affects: Easy Elements for Elementor – Addons & Website Templates (easy-elements WordPress plugin). Tags: wordpress, elementor, easy-elements, privilege-escalation, cwe-269, unauthenticated, ajax, wp-capabilities.webHighwordpresselementoreasy-elementsprivilege-escalationcwe-269unauthenticatedajaxwp-capabilitieshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/High severity (CVSS 3.1) — web · CVE-2026-54415. Status: PoC. Affects: Azuriom CMS. Tags: azuriom, cms, broken-access-control, cwe-862, cwe-269, privilege-escalation, account-takeover, php, laravel, azlink.webHighazuriomcmsbroken-access-controlcwe-862cwe-269privilege-escalationaccount-takeoverphplaravelazlink