Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Unauthenticated remote control of Argo CD in argocd-mcp 0.8.0, the Model Context Protocol server for Argo CD, arises because the HTTP transport binds to all network interfaces and accepts MCP sessions without any caller credential once ARGOCD_API_TOKEN is set. Any attacker with network reach to the listener can drive the full MCP tool surface under the operator's stored token to create applications, trigger syncs, and mutate Argo CD resources. Rated CVSS 10.0 by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. No public exploit identified at time of analysis, and exploitation requires the plugin's 'User Role Selection' feature to be enabled.
Out-of-bounds kernel heap write in the Linux kernel's GRO (Generic Receive Offload) BIG TCP path allows corruption of memory before skb->head when aggregating oversized (>64KB) packets. The flaw stems from skb_gro_receive() using a loose headroom check introduced by the IPv4 BIG TCP support commit (b1a78b9b9886); crafted frames - for example injected via AF_PACKET with a MAC header under 8 bytes - pass validation, so ipv6_gro_complete()'s memmove() for the temporary HBH jumbo header writes before skb->head and wraps skb->mac_header. It also let software VLAN and encapsulated flows (SIT/IPv6-in-IPv4) aggregate beyond 64KB. No public exploit is identified at time of analysis and EPSS is low (0.19%), and the issue affects only older stable branches (e.g. 6.18.y), not mainline 7.0+.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. Reported by VulnCheck; a vendor patch (2.46.0) exists and the fix commit ships a reproduction test, but there is no public exploit identified and no active exploitation on record.
Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. No public exploit identified at time of analysis, but a vendor-released patch (v19.20.2) and a fixing commit with a working url-encoded traversal test case are publicly available, lowering the barrier to reproduction.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.