Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated attackers can reach every Wukong_HRM API endpoint and operate with HR administrator privileges, because the platform's ParamAspect authorization component treats an absent AUTH-TOKEN header as an implicit pass instead of a denial. Exploitation requires nothing more than network reachability to the HRM API on a build at or before commit 186115e - no credentials, token, configuration change, or user interaction - and it exposes payslips, salary history, and employee personal data, permits attachment downloads, and allows modification or deletion of company-wide HR records. Publicly available exploit code exists (multiple proof-of-concept scripts published alongside the VulnCheck advisory), the CVSS 4.0 base score is 9.3, and no confirmed active exploitation (CISA KEV) has been reported; the risk is nevertheless genuine rather than CVSS-inflated, since the bypass is triggered by simply omitting a request header.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated OS command injection in TOZED X300 devices up to firmware version 6.01.3 allows remote attackers to execute arbitrary operating system commands by supplying shell metacharacters in the Host argument of the IP Ping Diagnostics feature, which is typically exposed through the device's web management interface. All severity signals converge on maximum risk: the vulnerability scores 10.0 under CVSS 4.0 with high impact to confidentiality, integrity, and availability, and the vendor did not respond to disclosure and has not released a patch. Exploitation is limited primarily by whether the diagnostics interface is reachable from the attacker's network, as it is often bound to a LAN or administrative VLAN rather than the WAN; no public exploit identified at time of analysis.
Hard-coded JWT signing key in BotSharp through 5.2.0 allows unauthenticated remote attackers to forge bearer tokens and impersonate any user, including administrators, on Authorize-protected API routes. Exploitation requires the deployment to retain the default key and default 'botsharp' issuer/audience; rotating these values mitigates the issue. No public exploit code has been identified at the time of analysis, but the high impact and low complexity make this a genuine high-priority risk as confirmed by independent assessment.
Unauthenticated remote attackers can achieve full administrative control of self-hosted Agnai instances (versions through 1.0.555) deployed with the default self-host.docker-compose.yml, which contains a hard-coded admin password and a public JWT secret. Attackers can log in as admin or forge a JWT with admin privileges to impersonate users, reset passwords, and modify server configuration. This critical vulnerability (CVSS 9.3) requires no user interaction and no prior authentication, but exploitation is limited to instances that have not overridden the default credentials and are network-reachable. No public exploit code has been identified at the time of analysis, though the hard-coded secrets are publicly visible in the repository.