https://poc.intelseclab.com/tags/wordpress/Latest proof-of-concept entries.Hugoen-usSat, 05 Sep 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-09-05_cve-2026-11613-divi-ajax-filter-lfi/Sat, 05 Sep 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-09-05_cve-2026-11613-divi-ajax-filter-lfi/Critical severity (CVSS 9.8) — web · CVE-2026-11613. Status: PoC. Affects: Divi Ajax Filter plugin for WordPress. Tags: LFI, WordPress, Divi, unauthenticated, Python.webCriticalLFIWordPressDiviunauthenticatedPythonhttps://poc.intelseclab.com/pocs/web/2026-09-03_cve-2026-82970-wplp-cookie-consent-rce/Thu, 03 Sep 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-09-03_cve-2026-82970-wplp-cookie-consent-rce/Critical severity (CVSS 10) — web · CVE-2026-82970. Status: Weaponized. Affects: WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (WordPress plugin). Tags: RCE, WordPress, file upload, unauthenticated, PHP, webshell.webCriticalRCEWordPressfile uploadunauthenticatedPHPwebshellhttps://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmshttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Critical severity (CVSS 9.1) — web · CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf. Status: Weaponized — full pre-auth RCE confirmed against stock-default WordPress core, no plugins/misconfiguration required. Affects: WordPress core (REST API /batch/v1, WP_Query::author__not_in). Tags: wordpress, wp-core, sql-injection, route-confusion, cwe-89, cwe-436, unauthenticated, remote, privilege-escalation, rce, oembed, changeset.webCriticalwordpresswp-coresql-injectionroute-confusioncwe-89cwe-436unauthenticatedremoteprivilege-escalationrceoembedchangesethttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-11170. Status: Weaponized. Affects: WP移行専用プラグイン for CPI (cpi-wp-migration, a CPI/site-migration import plugin for WordPress). Tags: wordpress, cpi-wp-migration, unauthenticated-file-upload, rce, admin-ajax, cwe-434, python.webCriticalwordpresscpi-wp-migrationunauthenticated-file-uploadrceadmin-ajaxcwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13390-wp-directory-kit-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13390-wp-directory-kit-auth-bypass/Critical severity (CVSS 10) — web · CVE-2025-13390. Status: Weaponized. Affects: WP Directory Kit (WordPress plugin). Tags: wordpress, wp-directory-kit, authentication-bypass, predictable-token, account-takeover, webshell-upload, python, cwe-287.webCriticalwordpresswp-directory-kitauthentication-bypasspredictable-tokenaccount-takeoverwebshell-uploadpythoncwe-287https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Critical severity (CVSS 10) — web · CVE-2025-39401. Status: Weaponized. Affects: WPAMS (WordPress Apartment/Property Management System) plugin by mojoomla. Tags: wordpress, wpams, mojoomla, arbitrary-file-upload, webshell, rce, unauthenticated, python, multithreaded, cwe-434.webCriticalwordpresswpamsmojoomlaarbitrary-file-uploadwebshellrceunauthenticatedpythonmultithreadedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49901-simple-link-directory-password-reset-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49901-simple-link-directory-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-49901. Status: Weaponized. Affects: WordPress "Simple Link Directory" plugin (qc-simple-link-directory by quantumcloud). Tags: wordpress, wordpress-plugin, simple-link-directory, qc-opd, authentication-bypass, password-reset, broken-authentication, cwe-288, username-enumeration, python.webCriticalwordpresswordpress-pluginsimple-link-directoryqc-opdauthentication-bypasspassword-resetbroken-authenticationcwe-288username-enumerationpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-5947-servicefinder-bookings-cookie-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-5947-servicefinder-bookings-cookie-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-5947. Status: Weaponized. Affects: WordPress plugin "Service Finder Bookings" (sf-booking). Tags: wordpress, service-finder-bookings, sf-booking, authentication-bypass, cookie-forgery, privilege-escalation, cwe-639.webCriticalwordpressservice-finder-bookingssf-bookingauthentication-bypasscookie-forgeryprivilege-escalationcwe-639https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Critical severity (CVSS 9.8) — web · CVE-2025-68860. Status: Weaponized. Affects: WordPress "Mobile Builder" plugin. Tags: wordpress, mobile-builder, jwt, authentication-bypass, hardcoded-secret, privilege-escalation, rest-api, python, cwe-288.webCriticalwordpressmobile-builderjwtauthentication-bypasshardcoded-secretprivilege-escalationrest-apipythoncwe-288https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Critical severity (CVSS 10) — web · CVE-2025-29009. Status: Weaponized. Affects: Webkul "Medical Prescription Attachment Plugin for WooCommerce" (WordPress plugin). Tags: wordpress, woocommerce, medical-prescription-attachment, unrestricted-file-upload, webshell, cwe-434, unauthenticated, python.webCriticalwordpresswoocommercemedical-prescription-attachmentunrestricted-file-uploadwebshellcwe-434unauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-12057. Status: Weaponized. Affects: WavePlayer (WordPress plugin). Tags: wordpress, waveplayer, arbitrary-file-upload, unauthenticated, rce, webshell, ajax, nonce, php, python.webCriticalwordpresswaveplayerarbitrary-file-uploadunauthenticatedrcewebshellajaxnoncephppythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Critical severity (CVSS 10) — web · CVE-2025-12539. Status: Weaponized. Affects: TNC Toolbox: Web Performance (WordPress plugin). Tags: wordpress, tnc-toolbox, sensitive-information-exposure, unauthenticated, cpanel, credential-theft, privilege-escalation, python.webCriticalwordpresstnc-toolboxsensitive-information-exposureunauthenticatedcpanelcredential-theftprivilege-escalationpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-48148. Status: Weaponized. Affects: StoreKeeper for WooCommerce (WordPress plugin). Tags: wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python.webCriticalwordpresswoocommercestorekeeperarbitrary-file-uploadunauthenticatedwebshellrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Critical severity (CVSS 9.8) — web · CVE-2025-6389. Status: Weaponized. Affects: Sneeit Framework (WordPress theme framework plugin, sneeit-framework). Tags: wordpress, sneeit-framework, rce, call_user_func, unauthenticated, wp_insert_user, privilege-escalation, admin-takeover, cwe-94, wp-ajax-nopriv.webCriticalwordpresssneeit-frameworkrcecall_user_funcunauthenticatedwp_insert_userprivilege-escalationadmin-takeovercwe-94wp-ajax-noprivhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-4334. Status: PoC. Affects: "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action). Tags: wordpress, wp-plugin, simple-user-registration, privilege-escalation, unauthenticated, admin-ajax, cwe-269, python.webCriticalwordpresswp-pluginsimple-user-registrationprivilege-escalationunauthenticatedadmin-ajaxcwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-53580. Status: Weaponized. Affects: quantumcloud "Simple Business Directory Pro" WordPress plugin (simple-business-directory-pro). Tags: wordpress, wordpress-plugin, simple-business-directory-pro, password-reset, privilege-escalation, incorrect-privilege-assignment, cwe-266, account-takeover, unauthenticated, python.webCriticalwordpresswordpress-pluginsimple-business-directory-propassword-resetprivilege-escalationincorrect-privilege-assignmentcwe-266account-takeoverunauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-9209-restropress-jwt-forgery/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-9209-restropress-jwt-forgery/Critical severity (CVSS 9.8) — web · CVE-2025-9209. Status: Weaponized. Affects: RestroPress – Online Food Ordering System (WordPress plugin). Tags: restropress, wordpress, wordpress-plugin, information-exposure, jwt, authentication-bypass, account-takeover, rest-api, mass-scanner, cwe-200, cwe-287, python.webCriticalrestropresswordpresswordpress-plugininformation-exposurejwtauthentication-bypassaccount-takeoverrest-apimass-scannercwe-200cwe-287pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-6758. Status: Weaponized. Affects: Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler). Tags: wordpress, real-spaces, imic, privilege-escalation, unauthenticated, admin-ajax, role-assignment, cwe-269, cwe-863, python.webCriticalwordpressreal-spacesimicprivilege-escalationunauthenticatedadmin-ajaxrole-assignmentcwe-269cwe-863pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-11391. Status: Patched. Affects: PPOM for WooCommerce (woocommerce-product-addon plugin). Tags: wordpress, woocommerce, ppom, product-addon, sql-injection, blind-sqli, time-based, cwe-89, python, php.webCriticalwordpresswoocommerceppomproduct-addonsql-injectionblind-sqlitime-basedcwe-89pythonphphttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-10147-podlove-podcast-publisher-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-10147-podlove-podcast-publisher-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-10147. Status: Weaponized. Affects: Podlove Podcast Publisher (WordPress plugin). Tags: wordpress, podlove, podcast-publisher, unauthenticated-file-upload, rce, cwe-434, python.webCriticalwordpresspodlovepodcast-publisherunauthenticated-file-uploadrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Critical severity (CVSS 9.8) — web · CVE-2025-6934. Status: Weaponized. Affects: Opal Estate Pro (WordPress real-estate plugin). Tags: wordpress, opal-estate-pro, privilege-escalation, unauthenticated-registration, admin-ajax, nonce-abuse, cwe-269, python.webCriticalwordpressopal-estate-proprivilege-escalationunauthenticated-registrationadmin-ajaxnonce-abusecwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2294-kubio-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2294-kubio-lfi/Critical severity (CVSS 9.8) — web · CVE-2025-2294. Status: PoC. Affects: Kubio AI Page Builder (WordPress plugin). Tags: wordpress, kubio, page-builder, lfi, local-file-inclusion, unauthenticated, php, python, cwe-98.webCriticalwordpresskubiopage-builderlfilocal-file-inclusionunauthenticatedphppythoncwe-98https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12674-kiotviet-sync-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12674-kiotviet-sync-file-upload/Critical severity (CVSS 9.8) — web · CVE-2025-12674. Status: Weaponized. Affects: KiotViet Sync (WordPress plugin). Tags: wordpress, kiotviet-sync, arbitrary-file-upload, unauthenticated, rce, rest-api, webshell, python.webCriticalwordpresskiotviet-syncarbitrary-file-uploadunauthenticatedrcerest-apiwebshellpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14440-jay-login-register-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14440-jay-login-register-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-14440. Status: Weaponized. Affects: JAY Login & Register (WordPress plugin). Tags: wordpress, jay-login-register, authentication-bypass, cookie-manipulation, unauthenticated, python, cwe-287, cwe-290.webCriticalwordpressjay-login-registerauthentication-bypasscookie-manipulationunauthenticatedpythoncwe-287cwe-290https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Critical severity (CVSS 9.8) — web · CVE-2025-13342. Status: Weaponized. Affects: Frontend Admin by DynamiApps (WordPress plugin built on Advanced Custom Fields / ACF frontend forms). Tags: wordpress, wordpress-plugin, frontend-admin, dynamiapps, acf, advanced-custom-fields, broken-access-control, cwe-284, privilege-escalation, unauthenticated, admin-takeover, python.webCriticalwordpresswordpress-pluginfrontend-admindynamiappsacfadvanced-custom-fieldsbroken-access-controlcwe-284privilege-escalationunauthenticatedadmin-takeoverpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Critical severity (CVSS 9.8) — web · CVE-2025-14156. Status: Weaponized. Affects: Fox LMS (WordPress LMS plugin). Tags: wordpress, fox-lms, rest-api, privilege-escalation, role-injection, unauthenticated, python, cwe-269.webCriticalwordpressfox-lmsrest-apiprivilege-escalationrole-injectionunauthenticatedpythoncwe-269https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Critical severity (CVSS 9.8) — web · CVE-2025-49071. Status: Weaponized. Affects: Flozen Theme for WordPress. Tags: wordpress, flozen-theme, arbitrary-file-upload, unauthenticated, webshell, zip-upload, rce, cwe-434, python.webCriticalwordpressflozen-themearbitrary-file-uploadunauthenticatedwebshellzip-uploadrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13595-cibeles-ai-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13595-cibeles-ai-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13595. Status: Weaponized. Affects: Cibeles AI (WordPress plugin). Tags: wordpress, cibeles-ai, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.webCriticalwordpresscibeles-aiunauthenticated-file-uploadgithub-mirror-abusewebshellpythoncwe-434cwe-306https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13597-ai-feeds-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13597-ai-feeds-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13597. Status: Weaponized. Affects: AI Feeds (WordPress plugin). Tags: wordpress, ai-feeds, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.webCriticalwordpressai-feedsunauthenticated-file-uploadgithub-mirror-abusewebshellpythoncwe-434cwe-306https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Critical severity (CVSS 9.8) — web · CVE-2025-11749. Status: Weaponized. Affects: AI Engine plugin for WordPress (mwai). Tags: wordpress, ai-engine, mwai, mcp, rest-api, information-disclosure, privilege-escalation, admin-account-creation, python, mass-scanner.webCriticalwordpressai-enginemwaimcprest-apiinformation-disclosureprivilege-escalationadmin-account-creationpythonmass-scannerhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13486. Status: Weaponized. Affects: Advanced Custom Fields: Extended (ACFE) — WordPress plugin. Tags: wordpress, acf-extended, acfe, call_user_func_array, unauthenticated-rce, privilege-escalation, admin-account-creation, python, cwe-94.webCriticalwordpressacf-extendedacfecall_user_func_arrayunauthenticated-rceprivilege-escalationadmin-account-creationpythoncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/High severity (CVSS 7.2) — web · CVE-2026-1937. Status: Weaponized. Affects: YayMail – WooCommerce Email Customizer plugin for WordPress. Tags: wordpress, woocommerce, plugin, missing-authorization, privilege-escalation, mass-exploitation, ajax.webHighwordpresswoocommercepluginmissing-authorizationprivilege-escalationmass-exploitationajaxhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1357-wpvivid-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1357-wpvivid-file-upload-rce/Critical severity — web · CVE-2026-1357. Status: Weaponized. Affects: WPvivid Backup & Migration WordPress plugin. Tags: wordpress, wpvivid, arbitrary-file-upload, rce, unauthenticated, cryptography, path-traversal.webCriticalwordpresswpvividarbitrary-file-uploadrceunauthenticatedcryptographypath-traversalhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49105. Status: PoC. Affects: WP Zendesk for Contact Form 7 plugin for WordPress, cf7-zendesk.php. Tags: wordpress, zendesk, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpresszendeskphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40791-wp-time-slots-booking-xss/High severity (CVSS 7.2) — web · CVE-2026-40791. Status: PoC. Affects: WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin). Tags: wordpress, wordpress-plugin, stored-xss, unauthenticated, cwe-79, admin-takeover, booking-form.webHighwordpresswordpress-pluginstored-xssunauthenticatedcwe-79admin-takeoverbooking-formhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Critical severity (CVSS 8.6) — web · CVE-2026-6379. Status: PoC. Affects: WordPress plugin "WP Photo Album Plus" (WPPA+) by opajaap. Tags: wordpress, wp-photo-album-plus, sql-injection, unauthenticated, time-based-blind, cwe-89.webCriticalwordpresswp-photo-album-plussql-injectionunauthenticatedtime-based-blindcwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49085. Status: PoC. Affects: WP Insightly (Contact Form 7 to Insightly CRM integration) plugin for WordPress, cf7-insightly.php. Tags: wordpress, insightly, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpressinsightlyphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/High severity (CVSS 8.8) — web · CVE-2026-5415. Status: PoC. Affects: WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA). Tags: wordpress, wp-captcha-pro, auth-bypass, privilege-escalation, nonce, ajax, account-takeover, plugin.webHighwordpresswp-captcha-proauth-bypassprivilege-escalationnonceajaxaccount-takeoverpluginhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Critical severity (CVSS 9.8) — web · CVE-2026-54806. Status: PoC. Affects: WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress. Tags: wordpress, wp-activity-log, wp-security-audit-log, php-object-injection, deserialization, cwe-502, blind-rce, gadget-chain.webCriticalwordpresswp-activity-logwp-security-audit-logphp-object-injectiondeserializationcwe-502blind-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0745-uls-plugin-ssrf/Medium severity — web · CVE-2026-0745 (GHSA-m38c-5p3m-p7gm). Status: PoC. Affects: WordPress "User Language Switch" plugin. Tags: wordpress, ssrf, plugin-vulnerability, admin-ajax, cwe-918, metadata-endpoint.webMediumwordpressssrfplugin-vulnerabilityadmin-ajaxcwe-918metadata-endpointhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-12416, CVE-2026-12417. Status: Weaponized. Affects: SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416). Tags: wordpress, wp-plugin, account-takeover, password-reset, auth-bypass, ajax, mass-exploitation.webCriticalwordpresswp-pluginaccount-takeoverpassword-resetauth-bypassajaxmass-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/High severity — web · CVE-2026-0740. Status: PoC. Affects: WordPress "Ninja Forms" plugin — file upload field/module. Tags: wordpress, ninja-forms, file-upload, webshell, admin-ajax, plugin-vulnerability, cwe-434.webHighwordpressninja-formsfile-uploadwebshelladmin-ajaxplugin-vulnerabilitycwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/High severity — web · CVE-2026-4106. Status: Weaponized. Affects: HT Mega – Absolute Addons for Elementor (WordPress plugin). Tags: wordpress, elementor, ht-mega, wp-ajax, pii-disclosure, missing-authorization, mass-scanner, plugin-vulnerability.webHighwordpresselementorht-megawp-ajaxpii-disclosuremissing-authorizationmass-scannerplugin-vulnerabilityhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Medium severity — web · CVE-2026-39676. Status: PoC. Affects: Download Manager plugin for WordPress. Tags: wordpress, wordpress-plugin, idor, missing-authorization, unauthenticated, download-manager.webMediumwordpresswordpress-pluginidormissing-authorizationunauthenticateddownload-managerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/High severity — web · CVE-2026-3180. Status: PoC. Affects: WordPress "Contest Gallery" plugin. Tags: wordpress, sqli, blind-sqli, plugin, admin-ajax, unauthenticated, php, boolean-based.webHighwordpresssqliblind-sqlipluginadmin-ajaxunauthenticatedphpboolean-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3844-wordpress-breeze-cache-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3844-wordpress-breeze-cache-file-upload/Critical severity — web · CVE-2026-3844. Status: PoC. Affects: Breeze Cache plugin for WordPress. Tags: wordpress, wordpress-plugin, unauthenticated, file-upload, rce, gravatar-cache, breeze-cache.webCriticalwordpresswordpress-pluginunauthenticatedfile-uploadrcegravatar-cachebreeze-cache