Wp-Ajax — PoC Archivehttps://poc.intelseclab.com/tags/wp-ajax/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000WooCommerce Dynamic Pricing & Discounts (WC Designer Pro) Unauthenticated File Upload RCE (CVE-2025-6440)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleiWordPress HT Mega (Absolute Addons for Elementor) Unauthenticated PII Disclosure (CVE-2026-4106)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/High severity — web · CVE-2026-4106. Status: Weaponized. Affects: HT Mega – Absolute Addons for Elementor (WordPress plugin). Tags: wordpress, elementor, ht-mega, wp-ajax, pii-disclosure, missing-authorization, mass-scanner, plugin-vulnerability.webHighwordpresselementorht-megawp-ajaxpii-disclosuremissing-authorizationmass-scannerplugin-vulnerabilityLA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Critical severity (CVSS 9.8) — web · CVE-2026-0920. Status: Weaponized. Affects: LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit). Tags: wordpress, plugin, elementor, privilege-escalation, admin-takeover, unauthenticated, ajax, wp-ajax.webCriticalwordpresspluginelementorprivilege-escalationadmin-takeoverunauthenticatedajaxwp-ajax