AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-16
CVE-2026-2373: Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 – Missing Authorization to Unauthenticated Custom Post Type Contents Exposure (royal-elementor-addons)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom…
2026-03-14
CVE-2026-2233: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 – Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter (wp-user-frontend)
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish…
2026-03-14
CVE-2026-1947: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 – Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id (nex-forms-express-wp-form-builder)
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.9 via the submit_nex_form() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to to overwrite arbitrary form entries via the 'nf_set_entry_update_id'…
2026-03-14
CVE-2026-1883: Wicked Folders <= 4.1.0 – Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion (wicked-folders)
The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and…
2026-03-14
CVE-2026-1870: Thim Kit for Elementor <= 1.3.7 – Missing Authorization to Unauthenticated Private Course Disclosure (thim-elementor-kit)
The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft…
2026-03-13
CVE-2026-1948: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 – Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license (nex-forms-express-wp-form-builder)
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_license() function in all versions up to, and including, 9.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to to deactivate the plugin license.
2026-03-12
CVE-2026-2466: DukaPress <= 3.2.4 – Unauthenticated Stored Cross-Site Scripting (dukapress)
The DukaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-03-12
CVE-2026-3891: Pix for WooCommerce <= 1.5.0 – Unauthenticated Arbitrary File Upload (payment-gateway-pix-for-woocommerce)
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote…
2026-03-12
CVE-2026-1704: Appointment Booking Calendar <= 1.6.9.29 – Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure (simply-schedule-appointments)
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible…
2026-03-12
CVE-2026-3045: Appointment Booking Calendar <= 1.6.9.29 – Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint (simply-schedule-appointments)
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.