AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-23
CVE-2026-23546: Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.4 – Authenticated (Subscriber+) Sensitive Data Exposure (classified-listing)
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.
2026-02-21
CVE-2026-2385: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 – Unauthenticated Email Relay (the-plus-addons-for-elementor-page-builder)
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees.…
2026-02-20
CVE-2026-25387: Image Optimizer by Elementor <= 1.7.1 – Missing Authorization (image-optimization)
The Image Optimizer by Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-02-20
CVE-2026-25389: EventPrime <= 4.2.8.3 – Unauthenticated Information Exposure (eventprime-event-calendar-management)
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.8.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
2026-02-20
CVE-2026-27541: Wholesale Suite <= 2.2.6 – Authenticated (Shop Manager) Privilege Escalation (woocommerce-wholesale-prices)
The Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.6.This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to that of an administrator.
2026-02-20
CVE-2026-27540: Woocommerce Wholesale Lead Capture <= 2.0.3.1 – Unauthenticated Arbitrary File Upload (woocommerce-wholesale-lead-capture)
The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.0.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
2026-02-20
CVE-2026-27542: Woocommerce Wholesale Lead Capture <= 2.0.3.1 – Unauthenticated Privilege Escalation (woocommerce-wholesale-lead-capture)
The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.3.1. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
2026-02-20
CVE-2026-25388: Ads Pro <= 5.0 – Missing Authorization (ap-plugin-scripteo)
The Ads Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-02-20
CVE-2025-14339: weMail <= 2.0.7 – Missing Authorization to Unauthenticated Form Deletion (wemail)
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to…
2026-02-19
CVE-2026-25385: URL Shortify <= 1.12.3 – Authenticated (Author+) Server-Side Request Forgery (url-shortify)
The URL Shortify – Simple and Easy URL Shortener plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.12.3. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.