AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-15260: MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification PoC, Patch Analysis & Rule
Medium CVE-2025-15260 in Woorewards (CVSS 6.5): MyRewards – Loyalty Points and Rewards for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0816: All push notification for WP <= 1.5.3 Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0816 in All Push Notification (CVSS 4.9): All push notification for WP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15268: Infility Global <= 2.14.46 Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass PoC, Patch Analysis & Rule
High CVE-2025-15268 in Infility Global (CVSS 7.5): Infility Global. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15368: SportsPress <= 2.7.26 Authenticated (Contributor+) Local File Inclusion via Shortcode PoC, Patch Analysis & Rule
High CVE-2025-15368 in Sportspress (CVSS 8.8): SportsPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.7.27.
March 18, 2026
CVE-2026-0742: Smart Appointment & Booking <= 1.0.7 Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-0742 in Smart Appointment Booking (CVSS 6.4): Smart Appointment & Booking. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.8.
March 18, 2026
CVE-2025-15482: Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-15482 in Chapa Payment Gateway For Woocommerce (CVSS 5.3): Chapa Payment Gateway Plugin for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0572: WebPurify Profanity Filter <= 4.0.2 Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options PoC, Patch Analysis & Rule
Medium CVE-2026-0572 in Webpurifytextreplace (CVSS 6.5): WebPurify Profanity Filter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0743: WP Content Permission <= 1.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0743 in Wp Content Permission (CVSS 4.4): WP Content Permission. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15508: Magic Import Document Extractor <= 1.0.6 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-15508 in Magic Import Document Extractor (CVSS 5.3): Magic Import Document Extractor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15507: Magic Import Document Extractor <= 1.0.5 Missing Authorization to Unauthenticated Plugin License Status Modification PoC, Patch Analysis & Rule
Medium CVE-2025-15507 in Magic Import Document Extractor (CVSS 5.3): Magic Import Document Extractor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.6.
March 18, 2026
CVE-2025-14461: Xendit Payment <= 6.0.2 Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid PoC, Patch Analysis & Rule
Medium CVE-2025-14461 in Woo Xendit Virtual Accounts (CVSS 5.3): Xendit Payment. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.1.0.
March 18, 2026
CVE-2026-1370: SIBS WooCommerce <= 2.2.0 Authenticated (Admin+) SQL Injection via 'referencedId' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1370 in Sibs Woocommerce (CVSS 4.9): SIBS - WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1755: Menu Icons by ThemeIsle <= 0.13.20 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1755 in Menu Icons (CVSS 6.4): Menu Icons by ThemeIsle. Atomic Edge summarizes impact, exploitability, and patch details. Update to 0.13.21.
March 18, 2026
CVE-2026-24944: Subscribe2 <= 10.44 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24944 in Subscribe2 (CVSS 5.3): Subscribe2. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 10.45.
March 18, 2026
CVE-2026-0681: Extended Random Number Generator <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PoC, Patch Analysis & Rule
Medium CVE-2026-0681 in Extended Random Number Generator (CVSS 4.4): Extended Random Number Generator. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15285: SEO Flow by LupsOnline <= 2.2.1 Unauthenticated Arbitrary Post/Category Modification PoC, Patch Analysis & Rule
High CVE-2025-15285 in Lupsonline Link Netwerk (CVSS 7.5): SEO Flow by LupsOnline. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.0.
March 18, 2026
CVE-2026-1756: WP FOFT Loader <= 2.1.39 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2026-1756 in Wp Foft Loader (CVSS 8.8): WP FOFT Loader. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-24946: Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24946 in Woocommerce Delivery Notes (CVSS 5.3): Print Invoice & Delivery Notes for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.9.0.
March 18, 2026
CVE-2026-24948: Reflector <= 1.2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-24948 in Reflector Plugins (CVSS 6.1): Reflector. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-24950: Authorsy <= 1.0.6 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
Medium CVE-2026-24950 in Authorsy (CVSS 5.3): Authorsy. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.7.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.