## The Exploit An authenticated WordPress user with subscriber-level access or higher can invoke privileged administrative functions by sending forged AJAX requests to multiple handlers in the Edwiser Bridge plugin. ```bash curl -X POST http://target.local/wp-admin/admin-ajax.p...
## The Exploit An authenticated WordPress user with subscriber-level access or higher can invoke privileged administrative functions by sending forged AJAX requests to multiple handlers in the Edwiser Bridge plugin. ```bash curl -X POST h...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the WordPress admin dashboard by crafting a malicious URL to the plugin's reports page. No authentication or user interaction beyond clicking a link is require...
Read article →## The Exploit An authenticated subscriber (role: `subscriber` or higher) can extract the admin nonce token from the frontend and use it to forge AJAX requests that would otherwise require proper administrative permissions. Because the non...
Read article →## The Exploit An attacker with control over an OAuth2-linked account's login method can trick the logout handler into redirecting to an external OIDC provider's logout endpoint, even when the user signed in via password form instead of OA...
Read article →## The Exploit An unauthenticated attacker can trick a site administrator into clicking a malicious link that clears all ThirstyAffiliates connection data (site UUID, account email, secret token) without the administrator's knowledge or co...
Read article →## The Exploit **An authenticated user with Editor-level access can read arbitrary files on the server by injecting path traversal sequences into the `logFile` AJAX parameter.** ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target....
Read article →## The Exploit An authenticated WordPress user with contributor-level access or above can inject arbitrary JavaScript into a page by crafting a malicious block attribute. The stored payload executes in the browser of any user who visits th...
Read article →## The Exploit **Scenario:** An authenticated Shop Manager (or higher role) with a valid WordPress session. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerable-site.local Content-Type: application/x-www-form-urlencoded Cookie:...
Read article →## The Exploit **A Subscriber-level user can inject arbitrary JavaScript into form definitions by calling the AI Form Builder endpoint without proper capability verification, then trigger code execution when any visitor renders the generat...
Read article →## The Exploit An unauthenticated attacker can export the complete activity time database as CSV by issuing a single GET request to the plugin's export handler. ```http GET /wp-admin/admin-ajax.php?action=activity_time_csv_url&url_export=...
Read article →## The Exploit An authenticated subscriber-level user can delete arbitrary Zoom meetings or change their state by sending an AJAX request that bypasses the plugin's authorization layer. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...
Read article →## The Exploit An authenticated attacker with contributor-level access can inject arbitrary JavaScript into a WordPress page via a malicious `iframeBox` shortcode. The payload persists in the post content and executes in the browsers of al...
Read article →## The Exploit An unauthenticated attacker with knowledge of a victim's email address can unsubscribe them from arbitrary mailing lists by brute-forcing a 32-character MD5 hash derived from the subscriber ID and email. No authentication, s...
Read article →## The Exploit Contributor-level or higher authenticated user (the minimum role needed to trigger the preview feature in Visual Link Preview). ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Content-Type: application/x-w...
Read article →## The Exploit An authenticated WordPress user with Editor role or above can inject arbitrary SQL by manipulating the search parameter in the Nelio AB Testing REST API endpoint. ```http POST /wp-json/nelio-ab-testing/v1/posts HTTP/1.1 Hos...
Read article →## The Exploit An authenticated WordPress user with subscriber-level permissions or higher can modify the default payment method setting for the entire RegistrationMagic plugin without holding administrative privileges. ```http POST /wp-a...
Read article →## The Exploit An attacker with network access to a FreeBSD host running WireGuard can modify in-flight tunnel packets without triggering authentication failure, provided they can estimate the receiver's replay window bounds. ```python #!...
Read article →## The Exploit An authenticated WordPress Author can forge requests to arbitrary internal hosts by poisoning the `$_SERVER['HTTP_HOST']` header through a crafted AJAX call. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerable-s...
Read article →## The Exploit **An unauthenticated attacker can retrieve campaign comments and metadata from any campaign by calling a REST endpoint with no authentication.** ```http GET /wp-json/give-api/v3/campaigns/comments?id=1&perPage=10 HTTP/1.1 H...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the WordPress admin dashboard by crafting a malicious directory entry with an HTML entity–encoded payload that decodes *after* sanitization. ```http POST /wp-...
Read article →## The Exploit An unauthenticated attacker can request sensitive booking data by sending a direct REST API call to the EventPrime booking endpoints without any authentication token or WordPress session. ```bash curl -X GET "http://target....
Read article →## The Exploit An authenticated user with *read* permission on a document can retrieve field-level changes for *any* other document in the same DocType, including fields they do not have permission to view. ```http GET /api/resource/Docum...
Read article →## The Exploit An authenticated user with any role can follow documents they should not have read access to, and receive change notifications for restricted data. ```http POST /api/resource/Document%20Follow HTTP/1.1 Host: frappe.example....
Read article →## The Exploit An authenticated user whose document read permissions have been revoked can still receive email notifications containing the full document data by leveraging the Document Follow feature, which fails to re-evaluate access con...
Read article →## The Exploit An attacker with the ability to supply malformed XML input to an expat parser can trigger an out-of-bounds read and infinite loop by sending a crafted UTF-16 byte sequence containing low surrogate pairs where high surrogates...
Read article →## The Exploit A low-privileged user with an active subscription or positive account balance can craft a request that injects unbounded token counts, image generation parameters, or audio durations into the billing calculation pipeline. Th...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the WordPress admin panel by crafting a malicious link containing a `<script>` tag in the `tab` GET parameter. ```http GET /wp-admin/admin.php?page=llms_txt_s...
Read article →## The Exploit An authenticated WordPress user with Author-level access or above can include and execute arbitrary PHP files from the server by injecting directory traversal sequences into the `template` parameter of a NextGEN Gallery shor...
Read article →## The Exploit **An unauthenticated attacker can forge a cookie to bypass authorization checks and access restricted registration form functionality.** ```http GET /wp-admin/admin-ajax.php?action=rm_form_submission_handler HTTP/1.1 Host: ...
Read article →## The Exploit An authenticated user with subscriber-level access or higher can modify any plugin configuration setting—including business name, email, logo, GDPR settings, and payment options—by chaining two AJAX endpoints to forge a vali...
Read article →## The Exploit An authenticated user with Subscriber-level access can escalate to Administrator by appending a crafted query parameter to any WordPress admin URL, triggering a privilege check that unconditionally grants `manage_options` ca...
Read article →## The Exploit An authenticated user with *any* role can follow a restricted document and receive email notifications containing field values and table row changes they have no permission to read. ```http POST /api/resource/Document%20Fol...
Read article →## The Exploit An attacker whose document read permissions have been revoked or restricted can continue to receive email notifications containing the full document data and field-level changes by remaining in the Document Follow subscripti...
Read article →## The Exploit An authenticated user with Student-level access can escalate their privileges to Administrator by sending a single REST API request that modifies their own `roles` parameter. The plugin fails to validate that only admins sho...
Read article →## The Exploit An authenticated WordPress user with contributor-level permissions (or higher) can extract the full template data—including layouts, styles, and HTML—from any private or draft Elementor template by sending a single AJAX requ...
Read article →## The Exploit An attacker can craft a specially malformed UTF-16 encoded XML document containing low surrogate code points positioned at specific byte offsets to trigger an out-of-bounds read in libexpat's character conversion routines, c...
Read article →## The Exploit An unauthenticated attacker with network access to any WordPress site running W3 Total Cache ≤2.9.3 can leak the `W3TC_DYNAMIC_SECURITY` constant by sending a single GET request with a spoofed User-Agent header. Once leaked,...
Read article →## The Exploit An unauthenticated attacker can trigger reflected XSS on the WordPress login page by crafting a malicious login URL that, when visited by a victim, injects arbitrary JavaScript into the response. No session or authentication...
Read article →## The Exploit An authenticated attacker with contributor-level access injects arbitrary JavaScript into the `other_attributes` parameter of a Related Posts widget configuration request, which is then stored in the database and executed in...
Read article →## The Exploit An unauthenticated attacker sends a single HTTP request to any stateless `streamable-HTTP` endpoint. The server will reuse the Terraform token (`Terraform-Token` header or `Authorization: Bearer <token>`) from any previous r...
Read article →## The Exploit An unauthenticated attacker who has obtained another user's MCP session ID (e.g., from logs, network sniffing, or prior session theft) can replay that session ID to perform arbitrary Terraform operations with the victim's pr...
Read article →## The Exploit The following exploit targets an unauthenticated attacker who can make HTTP requests to the MCP server's streamable-HTTP transport endpoint. By setting both a forged `Authorization` header and a `Terraform-Token` header, an ...
Read article →## The Exploit **Scenario:** An unauthenticated attacker makes a single request to the WordPress REST API endpoint that exposes Amelia's settings object. ```http GET /wp-json/ameliabooking/v1/settings HTTP/1.1 Host: target-site.local Acce...
Read article →## The Exploit An authenticated subscriber-level user can POST to an AJAX endpoint to modify shop settings without administrative approval, because the plugin validates CSRF tokens but skips capability checks. ```http POST /wp-admin/admin...
Read article →## The Exploit An unauthenticated attacker can store malicious JavaScript in a quiz alert message by triggering the alert system during quiz creation or submission, which is then executed in the browser of any user viewing the compromised ...
Read article →## The Exploit No authentication is required. The Pro version of Dokan must be active, and store reviews must be enabled. ```bash curl -s 'https://example.com/wp-json/dokan/v1/stores/1/reviews' | jq '.reviews[] | {id: .id, name: .reviewer...
Read article →## The Exploit An authenticated attacker with subscriber-level access can force the SSL setup state to appear complete and reset the SSL process state by sending a simple crafted request containing the `force_complete` parameter. ```http ...
Read article →## The Exploit Any authenticated WordPress user, including a subscriber, can delete arbitrary files on the server by sending the following HTTP request. The attacker sets the `stm_user_avatar_path` POST parameter to a path outside the uplo...
Read article →## The Exploit Requires an authenticated contributor-level user or above to store a malicious `separatorIconSVG` block attribute. ```bash # store the malicious separatorIconSVG payload in a Gutenberg block curl -sk -X POST "https://target...
Read article →## The Exploit An authenticated contributor (or higher) can store script code in the Instagram Feed widget settings and make it execute for any later visitor. ```bash # Store the payload in the Instagram Feed widget configuration curl 'ht...
Read article →