AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-03
CVE-2025-15268: Infility Global <= 2.14.46 – Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass (infility-global)
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append…
2026-02-03
CVE-2026-0816: All push notification for WP <= 1.5.3 – Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter (all-push-notification)
The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' parameter in all versions up to, and including, 1.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level…
2026-02-03
CVE-2025-15260: MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification (woorewards)
The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with…
2026-02-03
CVE-2025-15487: Code Explorer <= 1.4.6 – Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter (code-explorer)
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
2026-02-03
CVE-2026-0679: Fortis for WooCommerce <= 1.2.0 – Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint (fortis-for-woocommerce)
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.
2026-02-02
CVE-2026-0950: Spectra Gutenberg Blocks <= 2.19.17 – Unauthenticated Information Disclosure in Sensitive Data (ultimate-addons-for-gutenberg)
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for…
2026-02-02
CVE-2026-25023: Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 – Unauthenticated Information Exposure (contest-code-checker)
The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
2026-02-02
CVE-2026-25326: CMSMasters Content Composer <= 1.4.5 – Authenticated (Contributor+) Local File Inclusion (cmsmasters-content-composer)
The CMSMasters Content Composer plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used…
2026-02-02
CVE-2026-0909: WP ULike <= 4.8.3.1 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter (wp-ulike)
The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike_delete_history_api` AJAX action not verifying that the log entry being deleted belongs to the current user. This makes it possible for authenticated attackers, with Subscriber-level access and above (granted…
2026-02-02
CVE-2025-14274: Unlimited Elements for Elementor <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget (unlimited-elements-for-elementor)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.