AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 20, 2026
CVE-2026-9690: Media folder Addon <= 4.0.1 Unauthenticated Arbitrary File Download PoC, Patch Analysis & Rule
Critical CVE-2026-9690 in Wp Media Folder Addon (CVSS 9.1): Media folder Addon. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 20, 2026
CVE-2026-49107: Thrive Apprentice < 10.8.10.2 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49107 in Thrive Apprentice (CVSS 8.1): Thrive Apprentice < 10.8.10.2 - Unauthenticated PHP Object Injection. Atomic Edge summarizes impact, exploitability, and patch details.
June 20, 2026
CVE-2026-5305: Email Encoder < 0.3.12 (premium) < 1.0.25 (free) Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-5305 in Email Encoder Premium (CVSS 7.2): Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting. Atomic Edge summarizes impact, exploitability, and patch details.
June 20, 2026
CVE-2026-10737: SP Project & Document Manager <= 4.71 Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function PoC, Patch Analysis & Rule
High CVE-2026-10737 in Sp Client Document Manager (CVSS 7.5): SP Project & Document Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 14, 2026
CVE-2026-10586: Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 Authenticated (Author+) Server-Side Request Forgery PoC, Patch Analysis & Rule
High CVE-2026-10586 in Essential Blocks (CVSS 7.2): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.1.4.
June 14, 2026
CVE-2026-49768: Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49768 in Happyforms (CVSS 8.1): Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments &.... Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.26.14.
June 14, 2026
CVE-2026-49769: wpForo Forum <= 3.1.0 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49769 in Wpforo (CVSS 8.1): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.1.1.
June 14, 2026
CVE-2026-49767: wpForo Forum <= 3.1.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-49767 in Wpforo (CVSS 5.3): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
June 14, 2026
CVE-2026-49763: Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49763 in Cf7 Hubspot (CVSS 8.1): Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.8.
June 14, 2026
CVE-2026-49778: WPFunnels Pro <= 2.9.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-49778 in Wpfunnels Pro (CVSS 7.2): WPFunnels Pro. Atomic Edge summarizes impact, exploitability, and patch details.
June 14, 2026
CVE-2026-49764: RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-49764 in Custom Registration Form Builder With Submission Manager (CVSS 5.3): RegistrationMagic – User Registration Forms Plugin. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.0.8.7.
June 14, 2026
CVE-2026-49773: FV Flowplayer Video Player < 7.5.51.7212 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-49773 in Fv Wordpress Flowplayer (CVSS 6.4): FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Atomic Edge summarizes impact, exploitability, and patch details.
June 14, 2026
CVE-2026-49775: Welcart e-Commerce <= 2.11.28 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-49775 in Usc E Shop (CVSS 5.3): Welcart e-Commerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.11.29.
June 14, 2026
CVE-2026-49771: Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2026-49771 in Photo Gallery (CVSS 6.5): Photo Gallery by 10Web – Mobile-Friendly Image Gallery. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.42.
June 14, 2026
CVE-2026-49077: Wp EMember <= v10.2.2 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-49077 in Wp EMember (CVSS 5.3): Wp EMember. Atomic Edge summarizes impact, exploitability, and patch details.
June 14, 2026
CVE-2026-49770: WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49770 in Wp Travel Engine (CVSS 8.1): WP Travel Engine – Tour Booking Plugin – Tour Operator Software. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.8.0.
June 14, 2026
CVE-2026-49774: RD Station <= 5.6.0 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
High CVE-2026-49774 in Integracao Rd Station (CVSS 8.8): RD Station. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.7.2.
June 14, 2026
CVE-2026-49106: Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49106 in Cf7 Constant Contact (CVSS 8.1): Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.7.
June 14, 2026
CVE-2026-49776: GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-49776 in Gptranslate (CVSS 7.5): GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update...
June 14, 2026
CVE-2026-49109: Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49109 in Cf7 Salesforce (CVSS 8.1): Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.4.4.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.