AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 18, 2026
CVE-2026-4162: Gravity SMTP <= 2.1.4 Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall PoC, Patch Analysis & Rule
High CVE-2026-4162 in Gravitysmtp (CVSS 7.1): Gravity SMTP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 18, 2026
CVE-2026-1924: Aruba HiSpeed Cache <= 3.0.4 Cross-Site Request Forgery to Plugin Settings Reset PoC, Patch Analysis & Rule
Medium CVE-2026-1924 in Aruba Hispeed Cache (CVSS 4.3): Aruba HiSpeed Cache. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.5.
April 18, 2026
CVE-2026-4664: Customer Reviews for WooCommerce <= 5.103.0 Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4664 in Customer Reviews Woocommerce (CVSS 5.3): Customer Reviews for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.104.0.
April 18, 2026
CVE-2026-4305: Royal WordPress Backup & Restore Plugin <= 1.0.16 Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4305 in Royal Backup Reset (CVSS 6.1): Royal WordPress Backup & Restore Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.17.
April 18, 2026
CVE-2026-3360: Tutor LMS <= 3.9.7 Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter PoC, Patch Analysis & Rule
High CVE-2026-3360 in Tutor (CVSS 7.5): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.8.
April 18, 2026
CVE-2026-1263: Webling <= 3.9.0 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1263 in Webling (CVSS 6.4): Webling. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.1.
April 18, 2026
CVE-2026-4977: UsersWP <= 1.2.58 Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4977 in Userswp (CVSS 4.3): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.59.
April 18, 2026
CVE-2026-6443: Accordion and Accordion Slider 1.4.6 Injected Backdoor PoC, Patch Analysis & Rule
Critical CVE-2026-6443 in Accordion And Accordion Slider (CVSS 9.8): Accordion and Accordion Slider 1.4.6 - Injected Backdoor. Atomic Edge summarizes impact, exploitability, and patch details.
April 18, 2026
CVE-2026-2305: AddFunc Head & Footer Code <= 2.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields PoC, Patch Analysis & Rule
Medium CVE-2026-2305 in Addfunc Head Footer Code (CVSS 6.4): AddFunc Head & Footer Code. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.
April 18, 2026
CVE-2026-4057: Download Manager <= 3.3.51 Missing Authorization to Authenticated (Contributor+) Media File Protection Removal PoC, Patch Analysis & Rule
Medium CVE-2026-4057 in Download Manager (CVSS 4.3): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.52.
April 18, 2026
CVE-2026-5742: UsersWP <= 1.2.60 Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution PoC, Patch Analysis & Rule
Medium CVE-2026-5742 in Userswp (CVSS 6.4): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.61.
April 18, 2026
CVE-2026-4351: Perfmatters <= 2.5.9 Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4351 in Perfmatters (CVSS 8.1): Perfmatters. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 18, 2026
CVE-2026-5436: MW WP Form <= 5.1.1 Unauthenticated Arbitrary File Move via regenerate_upload_file_keys PoC, Patch Analysis & Rule
High CVE-2026-5436 in Mw Wp Form (CVSS 8.1): MW WP Form. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.2.
April 18, 2026
CVE-2026-1830: Quick Playground <= 1.3.1 Missing Authorization to Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-1830 in Quick Playground (CVSS 9.8): Quick Playground. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.2.
April 18, 2026
CVE-2026-5357: Download Manager <= 3.3.52 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-5357 in Download Manager (CVSS 6.4): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.3.53.
April 18, 2026
CVE-2026-4336: Ultimate FAQ Accordion Plugin <= 2.4.7 Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content PoC, Patch Analysis & Rule
Medium CVE-2026-4336 in Ultimate Faqs (CVSS 6.4): Ultimate FAQ Accordion Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.8.
April 18, 2026
CVE-2026-5711: Post Blocks & Tools <= 1.3.0 Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-5711 in Bnm Blocks (CVSS 6.4): Post Blocks & Tools. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.1.
April 18, 2026
CVE-2026-2712: WP-Optimize <= 4.5.0 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-2712 in Wp Optimize (CVSS 5.4): WP-Optimize. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.1.
April 17, 2026
CVE-2026-5207: LifterLMS <= 9.2.1 Authenticated (Custom+) SQL Injection via 'order' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5207 in Lifterlms (CVSS 6.5): LifterLMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.2.2.
April 17, 2026
CVE-2026-3371: Tutor LMS <= 3.9.7 Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification PoC, Patch Analysis & Rule
Medium CVE-2026-3371 in Tutor (CVSS 4.3): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.9.8.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.