AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-27379: NextScripts: Social Networks Auto-Poster <= 4.4.7 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-27379 affects the NextScripts Social Networks Auto-Poster plugin (up to version 4.4.7) with a CVSS score of 7.5. Authenticated attackers can exploit this file upload vulnerability to inject PHP objects, risking data deletion...
March 18, 2026
CVE-2026-27374: WooCommerce Order Details <= 3.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27374 affects the WooCommerce Order Details plugin (up to v3.1) with a medium severity score of 5.3. Unauthenticated attackers can exploit this remote code execution flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2026-27373: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-27373 affects the Tablesome plugin (up to version 1.2.3) with a medium severity CVSS score of 6.5. Authenticated users can exploit an SQL injection vulnerability, emphasizing the need for immediate patching.
March 18, 2026
CVE-2026-27370: Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty <= 3.5.1 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-27370 affects the Chaty plugin for WordPress (up to version 3.5.1) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data; update to version 3.5.2 to mitigate this risk.
March 18, 2026
CVE-2026-27384: W3 Total Cache <= 2.9.1 Unauthenticated Arbitrary Code Execution PoC, Patch Analysis & Rule
CVE-2026-27384 affects W3 Total Cache plugin (up to 2.9.1) with a critical CVSS score of 9.8. Unauthenticated remote code execution allows attackers to execute arbitrary code. Update to version 2.9.2 to mitigate this risk.
March 18, 2026
CVE-2026-27385: DesignThemes Portfolio <= 1.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27385 affects the DesignThemes Portfolio plugin (up to version 1.3) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 18, 2026
CVE-2026-23546: Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.4 Authenticated (Subscriber+) Sensitive Data Exposure PoC, Patch Analysis & Rule
CVE-2026-23546 affects the Classified Listing plugin for WordPress (up to version 5.3.4) with a CVSS score of 4.3. Authenticated users can exploit this medium-severity vulnerability to access sensitive data. Update to version 5.3.5.
March 18, 2026
CVE-2026-27397: Really Simple Security Pro <= 9.5.4.0 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-27397 affects the Really Simple SSL Pro plugin for WordPress, with a medium severity CVSS score of 4.3. Users should update from version 9.5.4.0 to mitigate unauthorized actions by authenticated attackers.
March 18, 2026
CVE-2026-27428: Eagle Booking <= 1.3.4.3 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-27428 affects the Eagle Booking plugin (up to 1.3.4.3) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated attackers can exploit this flaw to extract sensitive data; patching is essential.
March 18, 2026
CVE-2026-27396: Directory Pro <= 2.5.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27396 affects the Directory Pro plugin (up to v2.5.6) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity flaw, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-27389: WeDesignTech Ultimate Booking Addon <= 1.0.1 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-27389 is a critical authentication bypass vulnerability in the WeDesignTech Ultimate Booking Addon for WordPress, with a CVSS score of 9.8. Users should update to the patched version to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-27390: WeDesignTech Ultimate Booking Addon <= 1.0.1 Authenticated (Subscriber+) Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-27390 affects the WeDesignTech Ultimate Booking Addon for WordPress, allowing authenticated attackers to bypass authentication. Update to version 1.0.2 to mitigate this high-severity vulnerability (CVSS 8.8).
March 18, 2026
CVE-2026-27413: Profile Builder Pro <= 3.13.9 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-27413 affects the Profile Builder Pro plugin (up to v3.13.9) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows attackers to extract sensitive data. Users should patch immediately.
March 18, 2026
CVE-2026-27406: My Tickets – Accessible Event Ticketing <= 2.1.0 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-27406 affects the My Tickets plugin for WordPress (up to v2.1.0) with a medium severity CVSS score of 5.3. Unauthenticated users can access sensitive data; update to v2.1.1 to mitigate this risk.
March 18, 2026
CVE-2026-27411: SiteGuard WP Plugin <= 1.7.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27411 affects SiteGuard plugin versions up to 1.7.9, allowing unauthorized access due to a missing capability check. Users should patch to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-27388: DesignThemes Booking Manager <= 2.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27388 affects the DesignThemes Booking Manager plugin (up to version 2.0) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity flaw, making patching essential for security.
March 18, 2026
CVE-2026-2385: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 Unauthenticated Email Relay PoC, Patch Analysis & Rule
CVE-2026-2385 affects The Plus Addons For Elementor Page Builder (up to 6.4.7) with a CVSS score of 5.3. It allows unauthenticated email relay and redirection. Update to version 6.4.8 to mitigate this vulnerability.
March 18, 2026
CVE-2026-27386: DesignThemes Directory Addon <= 1.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27386 affects the DesignThemes Directory Addon plugin for WordPress (up to version 1.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14339: weMail <= 2.0.7 Missing Authorization to Unauthenticated Form Deletion PoC, Patch Analysis & Rule
CVE-2025-14339 affects the weMail plugin (up to v2.0.7) with a medium severity score of 6.5. Unauthenticated users can delete forms due to insufficient permission checks. Upgrade to v2.0.8 to mitigate this risk.
March 18, 2026
CVE-2026-25388: Ads Pro <= 5.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25388 affects the Ap Plugin Scripteo (versions up to 5.0) with a medium severity CVSS score of 4.3. Authenticated users can exploit this vulnerability for unauthorized actions. Ensure you update to the patched version.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.