Wp-Plugin — PoC Archivehttps://poc.intelseclab.com/tags/wp-plugin/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-4334. Status: PoC. Affects: "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action). Tags: wordpress, wp-plugin, simple-user-registration, privilege-escalation, unauthenticated, admin-ajax, cwe-269, python.webCriticalwordpresswp-pluginsimple-user-registrationprivilege-escalationunauthenticatedadmin-ajaxcwe-269pythonWordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-12416, CVE-2026-12417. Status: Weaponized. Affects: SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416). Tags: wordpress, wp-plugin, account-takeover, password-reset, auth-bypass, ajax, mass-exploitation.webCriticalwordpresswp-pluginaccount-takeoverpassword-resetauth-bypassajaxmass-exploitationWordPress "Form Maker" Plugin Unauthenticated SQL Injection — CVE-2026-3359https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Critical severity — web · CVE-2026-3359. Status: PoC. Affects: WordPress "Form Maker" plugin by Web10. Tags: wordpress, sql-injection, form-maker, unauthenticated, admin-ajax, wp-plugin, data-exfiltration.webCriticalwordpresssql-injectionform-makerunauthenticatedadmin-ajaxwp-plugindata-exfiltrationmidi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-1306. Status: Weaponized. Affects: midi-Synth WordPress plugin. Tags: wordpress, wp-plugin, file-upload, cwe-434, webshell, ajax, mass-scanning.webCriticalwordpresswp-pluginfile-uploadcwe-434webshellajaxmass-scanningFriendly Functions for Welcart WordPress Plugin CSRF (CVE-2026-1208)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1208-welcart-plugin-csrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1208-welcart-plugin-csrf/Medium severity (CVSS 4.3) — web · CVE-2026-1208. Status: PoC. Affects: Friendly Functions for Welcart (WordPress plugin). Tags: wordpress, wp-plugin, csrf, welcart, cwe-352, settings-manipulation.webMediumwordpresswp-plugincsrfwelcartcwe-352settings-manipulation