AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-23
CVE-2026-4066: Smart Custom Fields <= 5.0.6 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search (smart-custom-fields)
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via…
2026-03-23
CVE-2026-2412: Quiz and Survey Master (QSM) <= 10.3.5 – Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter (quiz-master-next)
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters…
2026-03-23
CVE-2026-3225: LearnPress <= 4.3.2.8 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (learnpress)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete()…
2026-03-23
CVE-2026-4306: WP Job Portal <= 2.4.8 – Unauthenticated SQL Injection via 'radius' Parameter (wp-job-portal)
The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to, and including, 2.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries…
2026-03-23
CVE-2026-4056: User Registration & Membership <= 5.1.4 – Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (user-registration)
The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the `check_permissions()` method only checking for `edit_posts` capability instead of an administrator-level capability. This makes it possible…
2026-03-23
CVE-2026-3533: JupiterX Core <= 4.14.1 – Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import (jupiterx-core)
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with…
2026-03-23
CVE-2026-4021: Contest Gallery <= 28.1.5 – Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion (contest-gallery)
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` using the user's email string in a `WHERE ID = %s` clause instead of the numeric user ID, combined with…
2026-03-23
CVE-2026-3138: Product Filter for WooCommerce by WBW <= 3.1.2 – Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE (woo-product-filter)
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via `wp_ajax_nopriv_` hooks without verifying user capabilities, combined with the base controller's…
2026-03-23
CVE-2026-4662: JetEngine <= 3.8.6.1 – Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter (jet-engine)
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not…
2026-03-23
CVE-2026-4001: Woocommerce Custom Product Addons Pro <= 5.4.1 – Unauthenticated Remote Code Execution via Custom Pricing Formula (woo-custom-product-addons-pro)
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.