ubaii

3 exploits Active since Nov 2024
CVE-2024-10542 NOMISEC CRITICAL WORKING POC
CleanTalk Spam Protection <=6.43.2 - Unauthenticated Plugin Installation via DNS Spoofing
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
2 stars
CVSS 9.8
CVE-2025-2563 NOMISEC HIGH WRITEUP
User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
CVSS 8.1
CVE-2025-2594 NOMISEC HIGH WRITEUP
WordPress Plugin <4.1.3 - Auth Bypass
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
CVSS 8.1