AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-24372: Subscriptions for WooCommerce <= 1.8.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24372 affects the Subscriptions for WooCommerce plugin, allowing remote code execution due to a missing capability check. Users should update to version 1.8.11 or later to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-2631: Datalogics Ecommerce Delivery – Datalogics < 2.6.60 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-2631 affects the Datalogics plugin for WordPress, allowing unauthenticated attackers to escalate privileges to admin level. With a CVSS score of 9.8, users should update to the latest version to mitigate this critical risk.
March 23, 2026
CVE-2026-27046: StoreCustomizer – A plugin to Customize all WooCommerce Pages <= 2.6.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27046 affects the Woocustomizer plugin for WordPress, allowing remote code execution due to a missing capability check. Users should update to the patched version to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-27067: Mobile App Editor – WordPress to Android App Builder <= 1.3.1 Authenticated (Editor+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-27067 affects the Mobile App Editor plugin, rated high with a CVSS of 7.2. Authenticated attackers can exploit a file upload vulnerability. Patching is essential to mitigate potential remote code execution risks.
March 23, 2026
CVE-2026-1753: Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder < 1.6.1 Missing Authorization to Authenticated (Contributor+) Settings Update PoC, Patch Analysis & Rule
CVE-2026-1753 affects the Gutena Forms plugin for WordPress, allowing unauthorized access due to a missing capability check. Users should update to version 1.6.1 or later to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-2626: Divi Booster < 5.0.2 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-2626 affects the Divi Booster plugin for WordPress, with a high severity CVSS score of 8.1. Unauthenticated attackers can exploit a file upload vulnerability, so ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2025-69358: EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69358 affects the Eventprime Event Calendar Management plugin with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should patch to secure their installations.
March 23, 2026
CVE-2025-15473: Timetics – Appointment Booking Calendar & Scheduling System < 1.0.52 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-15473 affects the Timetics plugin for WordPress, rated medium severity (CVSS 5.3). It allows unauthorized access due to missing capability checks. Ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-27071: WPCafe – Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27071 affects the WP Cafe plugin, with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability for unauthorized actions. Ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-27065: BuilderPress <= 2.0.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-27065 affects the BuilderPress plugin for WordPress with a high severity CVSS score of 8.1. Unauthenticated attackers can exploit this authentication bypass vulnerability, leading to potential code execution. Ensure you update...
March 23, 2026
CVE-2026-27054: Penci Soledad Data Migrator <= 1.3.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27054 affects the Penci Data Migrator plugin for WordPress, with a medium severity (CVSS 6.1) due to cross-site scripting vulnerabilities. Users should update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-32543: Responsive Blocks – Page Builder for Blocks & Patterns <= 2.2.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32543 affects the Responsive Block Editor Addons plugin with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this vulnerability for unauthorized actions. Update to the latest version to mitigate risks.
March 23, 2026
CVE-2026-27068: Website LLMs.txt <= 8.2.6 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27068 affects the Website LLMs Txt plugin for WordPress, with a medium severity CVSS of 6.1. Unauthenticated attackers can exploit reflected XSS due to insufficient input sanitization. Update to the latest version to mitigate...
March 23, 2026
CVE-2026-32452: Avada (Fusion) Builder < 3.15.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32452 affects the Fusion Builder plugin for WordPress, rated medium severity with a CVSS of 5.3. Unauthenticated attackers can exploit this vulnerability, so ensure you update to the latest version to mitigate risks.
March 23, 2026
CVE-2026-32451: Avada (Fusion) Builder < 3.15.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32451 affects the Fusion Builder plugin for WordPress, allowing unauthorized access for authenticated users. Update to version 3.15.0 or later to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-23806: Job Postings <= 2.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-23806 affects the Job Postings plugin for WordPress, with a medium severity score of 5.3. Unauthenticated attackers can exploit this flaw for unauthorized actions. Users should update to the latest version to mitigate risks.
March 23, 2026
CVE-2026-32455: wp-meta-data-filter-and-taxonomy-filter PoC, Patch Analysis & Rule
CVE-2026-32455 affects the WP Meta Data Filter and Taxonomy Filter plugin, posing a potential risk. Users should apply patches promptly to mitigate any security threats.
March 23, 2026
CVE-2026-24364: wp-user-frontend PoC, Patch Analysis & Rule
CVE-2026-24364 impacts the WP User Frontend plugin, but lacks detailed metadata for severity and classification. Users should ensure they are on the latest patched version to mitigate potential risks.
March 23, 2026
CVE-2026-32450: profit-products-tables-for-woocommerce PoC, Patch Analysis & Rule
CVE-2026-32450 affects the Profit Products Tables for WooCommerce plugin, allowing remote code execution. Users should apply patches promptly to mitigate potential risks.
March 23, 2026
CVE-2026-3589: WooCommerce < 10.5.3 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-3589 affects WooCommerce versions up to 10.5.3, with a CVSS score of 4.3. This medium severity cross-site request forgery vulnerability allows unauthorized actions if an admin is tricked. Patching is essential.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.