Unauthenticated arbitrary file upload in the SimpleForm WordPress plugin through 3.10.2 lets remote attackers write files that may be executable by the web server, with remote code execution possible where the upload directory permits script execution. The handle_upload function derives the file extension before sanitization and lacks a server-side file-key allowlist, so a trailing-dot filename bypasses extension and MIME checks; the only gate is a nonce exposed in every public form's data-nonce attribute. No public exploit is identified in the provided data, but the vendor-reported severity is critical (CVSS 9.8) and the priority label is act_now.
Unauthenticated remote code execution in the weDevs Project Manager plugin for WordPress through version 4.1.1 lets remote attackers invoke arbitrary PHP functions by supplying a crafted 'id' parameter to the plugin's REST route. WordPress core runs the route's validate_callback before its permission_callback, so the plugin's Project_Manage_Capability authorization gate is bypassed; the validator concatenates the 'id' value into a pipe-delimited rule string, splits it, and calls each token as a dynamic PHP function without an allowlist. CVSS 3.1 scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the supplied decision label is act_now, and no public exploit identified at time of analysis in the provided intelligence.
Unauthenticated remote code execution is possible in Apache MINA 3.0.0 through 3.0.0-M2 when an application places the 3.0 codec module's JavaNativeMessageDecoder in a filter chain facing an untrusted peer: the decoder deserializes frame bytes with ObjectInputStream.readObject() and applies no class filter, so crafted input can drive a gadget chain already present on the application's classpath. Deployments that do not wire this decoder are unaffected, and the recommended 2.2.X branch does not contain the class. The 3.0 branch is inactive and explicitly unsupported, the vendor does not plan to release a fix, and no public exploit has been identified at time of analysis.
Unauthenticated PHP object injection in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin (all versions up to and including 7.1.1) lets remote attackers place an anonymous WooCommerce Store API checkout whose customer_note is carried verbatim into the generated invoice HTML and ultimately into unserialize() inside the bundled mPDF library, opening the path to server-side code execution. The described trigger works on a default install only when an offline gateway such as Direct Bank Transfer (BACS) or cheque is enabled, because the resulting 'on-hold' order status is what fires the invoice-generation hook; whether object injection escalates to full code execution depends on an exploitable PHP POP gadget chain being loadable in the target environment. No public exploit code was identified at time of analysis, but the vendor has shipped version 7.2.0 and the priority decision is act_now given the remote, unauthenticated, low-complexity profile reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N).
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Unauthenticated super-administrator access in Jpom 2.10.0 through 2.11.12 is possible through query-condition injection in the JPOM-USER-TOKEN header, where a value such as 'is not null' is treated by Hutool's Condition parser as an operator and bypasses LoginInterceptor authentication. The resulting super-administrator role can then use Jpom's script features to execute commands. The issue is rated act_now with CVSS 9.3; no CISA KEV entry or confirmed public exploit code is provided in the supplied data, and the trigger is remote and unauthenticated against default configurations.
Unauthenticated remote code execution affects AJ-Report through version 1.7.1 because Share-Tokens are signed with a hard-coded JWT secret that is identical across installations. An attacker can forge a token offline, set reportCode to 'dataSet', and reach the testTransform endpoint, which passes supplied script content to GroovyClassLoader. The issue is rated act_now by vuln.today and carries a CVSS 4.0 score of 9.3; no KEV designation or confirmed public exploit code is present in the supplied data, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary file deletion in the Acadlix LMS - AI Quiz Maker, Online Exam & Course plugin for WordPress (all versions up to and including 1.1.9) allows remote attackers to remove any file the web server can write or unlink, rated CVSS 9.1. The plugin registers a frontend REST route, post_delete_assessment_file_by_id, whose permission callback only validates a generic wp_rest nonce that the plugin itself publishes inside the public acadlixOptions JavaScript object on every frontend page, so an attacker can harvest the nonce from any public page and then submit a traversal path - the nominal subscriber-level requirement is effectively void, matching the PR:N vector. Deleting a sensitive file such as wp-config.php can take the site down or force a reinstall flow that frequently ends in remote code execution; no public exploit identified at time of analysis, but the priority label is act_now given the trivial prerequisites and destructive impact. No CISA KEV entry is associated with this CVE.
Unauthenticated attackers can trash every published popup on WordPress sites running the Popup Builder plugin through version 4.4.5 by sending a single GET request with the sg_popup_preview_id parameter. The plugin fails to verify authorization for the trash action (CWE-862), and a second flaw in SGPopup::find() causes the request to match all published popups so the deletion runs against each of them, affecting integrity and availability of popup content with no confidentiality impact. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis, and the vuln.today decision label is act_now.
Authenticated Subscriber-level users on WordPress sites running WP Booking System - Booking Calendar through 2.1.0.5 can delete calendar notes belonging to any calendar, because the wpbs_action_ajax_calendar_remove_note() AJAX handler performs no capability check before removing a note. The vendor-reported score is 9.1 and vuln.today assigns an act_now decision label, while our assessment scores the issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N: the discrepancy turns on authentication (the advisory vector uses PR:N, but an account is required per the description) and on whether note deletion constitutes an availability impact. No public exploit identified at time of analysis; exposure is concentrated on sites that permit open Subscriber-level registration, and the effect is confined to integrity loss of calendar notes with no confidentiality exposure or code execution.