Vulnerabilities

The CryptoPayment Gateway WordPress plugin versions 1.2.1 and 1.2.2 fails to enforce an authorization (capability) check on one of its AJAX endpoints, which means any unauthenticated visitor can invoke what should be administrative-only operations. An attacker triggers the flaw simply by sending a crafted request to the unprotected AJAX action — no valid session, nonce, or credentials are required. Successful abuse lets the attacker delete arbitrary files on the server (potentially destroying the site or enabling a WordPress reinstallation takeover by wiping wp-config.php), overwrite the payment gateway configuration, and retrieve stored wallet credentials in cleartext, which could lead to direct theft of cryptocurrency funds. Sites running the plugin at versions 1.2.1–1.2.2 are affected regardless of configuration. There is no known public PoC and no evidence of in-the-wild exploitation to date, though the CVSS 10.0 rating and trivial preconditions make patching urgent.

Do: Update the CryptoPayment Gateway plugin immediately to the latest version (anything after 1.2.2, per the advisory's fixed-range). Treat all wallet credentials and API keys handled by the plugin as compromised: rotate wallets/seed phrases, review the gateway configuration for unauthorized changes, and verify site files for unexpected deletions or modifications (including restoring from backup if wp-config.php was targeted). Until patched, block unauthenticated AJAX requests to the plugin's endpoints via WAF rules or disable the plugin.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The WP Component WordPress plugin through version 2.2.4 exposes an action to unauthenticated users that has no capability or nonce checks, and it takes both the option name and the option value directly from the request. This allows any unauthenticated attacker to overwrite arbitrary WordPress site options by sending a single crafted HTTP request. On single-site installations this leads to a full takeover, since the attacker can enable user registration with a default role of administrator and then create an administrator account. Any site running the plugin at or including version 2.2.4 is affected, and the advisory does not specify a fixed version. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the CVE is not on CISA's KEV list.

Do: Upgrade WP Component to a version later than 2.2.4 as soon as a patched release is available, or remove the plugin entirely if no fix is forthcoming. Inspect the site's options for tampering — particularly 'users_can_register' enabled and 'default_role' set to administrator — and audit the users list for unauthorized administrator accounts. Review access logs for unauthenticated POST requests hitting the plugin's option-writing action endpoint.

The piclect WordPress plugin through version 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory. An unauthenticated attacker can simply send a crafted file (for example, a PHP webshell) to the plugin's upload endpoint and then reach it via its public URL, achieving arbitrary code execution and full server compromise. Any site running piclect through 1.0 with the plugin active is affected, and the flaw requires no authentication, user interaction, or privileges (CVSS 9.8). There is no known public PoC and the issue is not in the CISA KEV catalog, so exploitation status is currently none known, though the attack itself is trivial to reproduce. Defenders should treat any site running this plugin as potentially compromised.

Do: There is no indicated patched version, so remove or disable the piclect plugin entirely until a fixed release is available. Immediately inspect the plugin's public upload directory and the webserver for unexpected files (especially .php or .phtml shells) and rotate credentials/keys if any are found. As an interim control, block unauthenticated POST requests to the plugin's upload endpoint at the WAF or reverse proxy.

The Masteriyo LMS WordPress plugin before 3.4.1 deserializes user-supplied metadata without validation when it is read back (CWE-502), enabling classic PHP object injection. An attacker holding even a minimal WordPress account (for example a subscriber created through open registration) can inject arbitrary PHP objects and, by abusing a gadget class bundled with the plugin's libraries, write and execute arbitrary code on the server. A weaker unauthenticated variant of the same flaw lets attackers with no account at all perform an arbitrary file write. The issue is rated critical at CVSS 3.1 9.9 with high impact on confidentiality, integrity, and availability, and affects all installations running versions before 3.4.1. The flaw was assigned via WPScan; no public proof of concept or in-the-wild exploitation is currently known.

Do: Upgrade Masteriyo LMS to version 3.4.1 or later immediately, since both the authenticated RCE and the unauthenticated file-write paths are fixed there. If your site allows open self-registration, review recently created low-privilege (subscriber) accounts for suspicious signups and consider temporarily disabling registration. Audit the server for unexpected files under the web root, webshells, or newly added administrator users, and verify the integrity of wp-content and your backups.

The DS Ad Rotator WordPress plugin through version 0.8 exposes an image upload handler that performs no capability check, nonce verification, or file-type validation. Any unauthenticated attacker can send a crafted upload request directly to the vulnerable endpoint and write arbitrary files — including PHP scripts — into a web-accessible directory, where they can be executed to obtain remote code execution. Successful exploitation gives the attacker full control of the affected site and its underlying server, including data theft, defacement, and further pivoting. All sites running DS Ad Rotator 0.8 or earlier are affected, and no fixed version has been released. No public proof of concept is known and the flaw is not on CISA's KEV list, but exploitation is trivial for anyone who locates the endpoint, so exposure should be treated as immediately dangerous.

Do: No patched release exists (every version through 0.8 is vulnerable), so deactivate and delete DS Ad Rotator and replace it with a maintained ad-rotation plugin. In the interim, block or restrict access to the plugin's upload endpoint via a WAF or web-server rule. Audit the plugin's upload directory and the site for unexpected .php files or recently modified files that could indicate a planted webshell; if any are found, assume full compromise and rotate all credentials, database keys, and salts.

The WebTotem Backups WordPress plugin through version 1.0.1 contains a chained flaw in its file-deletion function: it does not validate the user-supplied file path, does not verify the requesting user's capabilities, and discards the result of its own CSRF check. As a result, any authenticated user — even a low-privilege role such as subscriber — can submit the plugin's request with a crafted path and delete arbitrary files on the web server. Arbitrary file deletion on WordPress can enable full site takeover, for example by deleting wp-config.php to force the site back into its installation routine and reclaim it. All sites running the plugin through version 1.0.1 are affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no indication of active exploitation.

Do: Update the plugin if a release newer than 1.0.1 is available; if no fixed version exists, deactivate and delete WebTotem Backups and switch to an alternative backup solution. Audit file systems and logs for unexplained deletions — particularly wp-config.php, .htaccess, and index.php — and check whether the site was forced into a reinstall or otherwise tampered with. Additionally, review subscriber and other low-privilege accounts for unauthorized registrations, and consider a WAF rule blocking the plugin's file-deletion endpoint.

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 deletes a user-supplied file without validating the path or checking the requesting user's capabilities (CWE-73). This means any authenticated user — even a low-privileged subscriber — can supply a crafted file path, including paths outside the plugin's intended directory, and delete arbitrary files on the server. By removing critical files such as wp-config.php or .htaccess, an attacker can trigger a WordPress reinstallation/reconfiguration flow and ultimately take over the site, reflecting the critical 9.6 CVSS score with high integrity and availability impact. Sites running the plugin at or below 1.0.1, especially those with open registration or many subscriber-level accounts, are the most exposed. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

Do: Update to a version newer than 1.0.1 if the developer has released a fix; if no patched version exists, deactivate and delete the plugin. Restrict self-registration and review user lists for unexpected subscriber accounts, and verify server integrity by checking for missing or tampered core files (e.g., wp-config.php, index.php, .htaccess), restoring from a clean backup if any are found.

The Frontegg SAML SSO WordPress plugin through version 1.0.1 does not verify the cryptographic signature or issuer of SAML authentication responses before establishing a login session (CWE-287, improper authentication). An unauthenticated remote attacker can craft a forged SAML response for the target site and submit it to the plugin's SSO endpoint, which accepts it without any validation. This lets the attacker log in as any existing user — including administrators — and create arbitrary new accounts, resulting in complete site takeover (CVSS 3.1: 9.8, critical). Any WordPress site running this plugin at version 1.0.1 or earlier with SAML SSO in use is affected. No public proof of concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Upgrade to a patched release above 1.0.1 as soon as one is available (monitor WPScan and the WordPress.org plugin page); until then, disable or remove the plugin and use an alternative SAML SSO solution, or restrict access to the plugin's SAML assertion endpoint at the firewall/WAF. Inspect user lists and authentication logs for unexpected accounts or admin logins, delete any rogue accounts, and reset credentials for all privileged users.

CVE-2026-62105 is an unauthenticated PHP object injection flaw (CWE-502, deserialization of untrusted data) in the ThemeREX Addons plugin for WordPress, affecting all versions below 2.45.0. Because the vulnerable deserialization path is reachable over the network without authentication, privileges, or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N), any remote attacker can send a crafted serialized PHP payload to trigger it. Successful object injection can leverage PHP object chains in WordPress for high-impact outcomes such as arbitrary code execution, database manipulation, or file operations (CVSS 3.1 C:H/I:H/A:H), potentially leading to full site compromise. WordPress sites running ThemeREX Addons prior to 2.45.0 are affected, including sites where the plugin was installed automatically as a companion to a ThemeREX commercial theme rather than chosen by the site owner. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Update ThemeREX Addons to version 2.45.0 or later, checking the plugin list even on sites where it was installed automatically with a bundled ThemeREX theme. If immediate patching is not possible, apply WAF rules that restrict unauthenticated requests to the plugin's endpoints and review logs for unexpected admin users, modified files, or unusual serialized input. No public PoC or known exploitation is currently reported, but treat this critical (9.8) issue as a priority patch.

CVE-2026-62103 is an unauthenticated PHP object injection vulnerability in the Everest Forms WordPress plugin, caused by deserialization of untrusted data (CWE-502). An attacker who can reach the affected code path without logging in can supply crafted serialized values, causing the plugin to instantiate arbitrary PHP objects. Depending on the object classes (gadget chains) present in a site's installed plugins, this can escalate to arbitrary file deletion, data modification, and potentially remote code execution, consistent with the assigned critical 9.8 CVSS score. All WordPress sites running Everest Forms version 3.6.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there is no confirmed exploitation in the wild at this time.

Do: Update Everest Forms to the latest available release (any version above 3.6.0) on all WordPress sites, prioritizing internet-facing sites given the unauthenticated, network-exploitable nature of the flaw. If patching must be delayed, deactivate the plugin as a stopgap and review web server and WordPress logs for suspicious unauthenticated requests or signs of object-injection abuse.

The advanced-customized-prompts WordPress plugin through version 1.0.1 fails to verify the password before issuing an authenticated session for a supplied email address via an unauthenticated action, an improper authentication flaw (CWE-287). An unauthenticated remote attacker can trigger this by submitting any registered user's email address to the affected endpoint and receive a valid logged-in session without ever knowing the password, or can create arbitrary new accounts. This grants full control of the impersonated account, including administrator accounts, potentially leading to complete site takeover. Any WordPress site running the plugin at version 1.0.1 or earlier is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA KEV.

Do: Deactivate or remove the advanced-customized-prompts plugin until a patched release newer than 1.0.1 is published, then update to the latest fixed version. Audit WordPress user accounts and authentication logs for unexpected admin sessions or newly created accounts, and rotate credentials for privileged users as a precaution.

CVE-2026-14560 is an unauthenticated arbitrary file upload flaw in the teddy-bear-customize-addon WordPress plugin (all versions through 1.0.5) that leads to remote code execution, classified as CWE-94 code injection. The plugin fails to validate uploads server-side, trusting the client-supplied content type and preserving the attacker's original filename, so an unauthenticated attacker can upload a file such as a PHP web shell directly to the server. When the uploaded PHP file is requested over the web, the attacker executes arbitrary code with the privileges of the web server, enabling full site compromise and potential lateral movement on shared hosting. Any WordPress installation running the plugin through 1.0.5 is affected; exposure is limited to sites using this niche customization addon. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time, but the trivially exploitable network vector (CVSS 10.0) makes opportunistic scanning likely.

Do: Update the teddy-bear-customize-addon plugin to the latest available version as soon as a patched release is published (all versions through 1.0.5 are vulnerable); if no fix is available yet, deactivate or remove the plugin. Audit the uploads directory for unexpected .php files and review access logs for unauthenticated POST requests to the upload endpoint to detect any compromise. As a stopgap, block direct execution of PHP files in the uploads directory or apply WAF rules requiring server-side validation of upload types.

CVE-2026-14559 is a critical authentication flaw (CWE-287) in the teddy-bear-customize-addon WordPress plugin, which authenticates users without verifying their password. An unauthenticated attacker who knows or guesses a registered user's email address can authenticate as that user through the plugin's login flow with no password required. Because the impersonated accounts include administrators, an attacker gains full control of the WordPress site, including the ability to install plugins or themes, edit files, and create new admin users for persistence. Any WordPress site running the plugin at version 1.0.5 or earlier is affected; the flaw requires no privileges or user interaction and is trivially exploitable over the network (CVSS 3.1: 9.8). No public proof-of-concept is known, the issue is not in CISA's KEV, and no in-the-wild exploitation has been documented as of this analysis.

Do: Deactivate or remove the teddy-bear-customize-addon plugin until a patched release beyond 1.0.5 is available, then update immediately, as no fixed version is documented in the data. Review authentication logs for administrator sign-ins without corresponding password activity, and rotate or reset credentials for privileged accounts if any suspicious logins are found. As an interim mitigation, a WAF rule or enforced password check on the plugin's login path can block the bypass.

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress is affected by an unrestricted file-upload flaw (CWE-434): the mipl_wc_upload_file function performs no file-type validation in all versions up to and including 1.2.1. An unauthenticated, remote attacker can trigger the flaw by submitting a crafted upload request over the network, with no authentication or user interaction required (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N). By uploading arbitrary files — for example a PHP script — to a web-executable location, the attacker may achieve remote code execution and compromise the site, matching the high confidentiality, integrity, and availability impact reflected in the critical 9.8 score. Any WordPress site, typically a WooCommerce store, running the plugin at version 1.2.1 or older is affected. As of the available data there is no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update the plugin to the first available release newer than 1.2.1 once a patched version is published (no fixed version number is stated in the available data), or deactivate the plugin until a fix ships. As an interim mitigation, deny PHP execution in the upload destination used by the plugin (typically under wp-content/uploads) via web-server rules so uploaded files cannot run. Because the flaw is exploitable by unauthenticated users on internet-facing stores, check the uploads directory for unexpected PHP or other unfamiliar files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoint.

CVE-2026-81800 is an unauthenticated SQL injection flaw (CWE-89) in the Verified Reviews (Avis Vérifiés) WordPress plugin, affecting all versions up to and including 2.4.6. Because the vulnerable code path requires no authentication (CVSS AV:N/PR:N/UI:N), a remote attacker can send crafted input — for example, a parameter handled by the plugin in a database query — and inject malicious SQL into the site's database. The published CVSS (C:H, I:N, A:L, scope changed) indicates the primary impact is high-confidentiality disclosure of database contents, with limited availability impact and no direct integrity impact; in practice this could expose data such as plugin-managed review/order data, WordPress user records and password hashes, and other tables in the database. Any WordPress site running the plugin at version 2.4.6 or earlier is affected. The issue was disclosed through Patchstack (the assigned CNA); it is not in CISA's KEV catalog and no public proof-of-concept or confirmed in-the-wild exploitation is currently known.

Do: Update the Verified Reviews (Avis Vérifiés) plugin on every affected site to the latest patched release (any version above 2.4.6, e.g., 2.4.7 or later once published). Until patched, consider deactivating the plugin or applying WAF rules that block SQL-injection patterns against the plugin's endpoints, and review web logs for suspicious unauthenticated requests to plugin routes. Since no public PoC exists, prioritize internet-exposed WordPress sites running the plugin.

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.