AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 14, 2026
CVE-2026-7648: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7648 in Learnpress (CVSS 4.3): LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.6.
May 14, 2026
CVE-2026-4030: Database Backup for WordPress <= 2.5.2 Missing Authorization to Unauthenticated Arbitrary File Read and Deletion PoC, Patch Analysis & Rule
High CVE-2026-4030 in Wp Db Backup (CVSS 8.1): Database Backup for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.3.
May 13, 2026
CVE-2026-6504: Royal Addons for Elementor <= 1.7.1058 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6504 in Royal Elementor Addons (CVSS 6.4): Royal Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.7.1059.
May 13, 2026
CVE-2026-6206: MW WP Form <= 5.1.2 Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6206 in Mw Wp Form (CVSS 5.3): MW WP Form. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.3.
May 13, 2026
CVE-2026-6514: InfusedWoo Pro <= 5.1.2 Unauthenticated Arbitrary File Read via 'url' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6514 in InfusedwooPRO (CVSS 7.5): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details.
May 13, 2026
CVE-2026-6145: User Registration & Membership <= 5.1.5 Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6145 in User Registration (CVSS 5.3): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.6.
May 13, 2026
CVE-2026-6252: Meta Field Block <= 1.5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6252 in Display A Meta Field As Block (CVSS 6.4): Meta Field Block. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.5.3.
May 13, 2026
CVE-2026-6225: Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6225 in Taskbuilder (CVSS 6.5): Taskbuilder – Project Management & Task Management Tool With Kanban Board. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.7.
May 13, 2026
CVE-2026-6670: Media Sync <= 1.4.9 Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-6670 in Media Sync (CVSS 6.5): Media Sync. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.0.
May 13, 2026
CVE-2026-6512: InfusedWoo Pro <= 5.1.2 Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters PoC, Patch Analysis & Rule
Critical CVE-2026-6512 in InfusedwooPRO (CVSS 9.1): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-5193: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 Authenticated (Author+) Limited Privilege Escalation via register_user PoC, Patch Analysis & Rule
Medium CVE-2026-5193 in Essential Addons For Elementor Lite (CVSS 6.5): Essential Addons for Elementor – Popular Elementor Templates & Widgets. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.6.0.
May 13, 2026
CVE-2026-3694: Bold Page Builder <= 5.6.8 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-3694 in Bold Page Builder (CVSS 6.4): Bold Page Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6510: InfusedWoo Pro <= 5.1.2 Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' PoC, Patch Analysis & Rule
Critical CVE-2026-6510 in InfusedwooPRO (CVSS 9.8): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6506: InfusedWoo Pro <= 5.1.2 Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update PoC, Patch Analysis & Rule
High CVE-2026-6506 in InfusedwooPRO (CVSS 8.8): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6174: CC Child Pages <= 2.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6174 in Cc Child Pages (CVSS 6.4): CC Child Pages. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.1.2.
May 13, 2026
CVE-2026-3718: ManageWP Worker <= 4.9.31 Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header PoC, Patch Analysis & Rule
High CVE-2026-3718 in Worker (CVSS 7.2): ManageWP Worker. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.9.32.
May 13, 2026
CVE-2026-5395: Fluent Forms <= 6.2.0 Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5395 in Fluentform (CVSS 8.2): Fluent Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.2.1.
May 13, 2026
CVE-2026-5365: LatePoint <= 5.3.2 Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route PoC, Patch Analysis & Rule
Medium CVE-2026-5365 in Latepoint (CVSS 4.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.4.0.
May 13, 2026
CVE-2025-15345: MapGeo Interactive Geo Maps <= 1.6.27 Reflected Cross-Site Scripting via 'map' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-15345 in Interactive Geo Maps (CVSS 6.1): MapGeo - Interactive Geo Maps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.28.
May 13, 2026
CVE-2026-6417: GLS Shipping for WooCommerce <= 1.4.0 Reflected Cross-Site Scripting via 'failed_orders' PoC, Patch Analysis & Rule
Medium CVE-2026-6417 in Gls Shipping For Woocommerce (CVSS 6.1): GLS Shipping for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.1.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.