Exploitation Summary
EIP tracks 4 public exploits for CVE-2026-0745. PoCs published by XiaomingX, blackhatlegend, HORKimhab.
AI-analyzed exploit summary This repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.
Description
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Exploits (4)
This repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.
The repository claims to exploit CVE-2026-0745, an SSRF vulnerability in the User Language Switch WordPress plugin, but lacks actual exploit code. Instead, it directs users to an external download link (tinyurl.com), which is a common tactic for distributing malware or monetizing fake exploits.
This repository contains a functional proof-of-concept exploit for CVE-2026-0745, demonstrating an SSRF vulnerability in the User Language Switch WordPress plugin. The script automates login and triggers the SSRF via a crafted request to admin-ajax.php.
The repository contains only a README.md file with minimal content (just the CVE identifier) and no exploit code or technical details. It appears to be a placeholder or incomplete submission.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N