T_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via order parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|\'\\\\s*(?:OR|AND)\\\\s+\\\\(?SELECT\\\\b)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via search parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39478-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39478", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.87 unauthenticated/contributor PHP Object Injection via GOTMLS_scan AJAX handler", "mode": "block", "severity": 8.8, "slug": "gotmls", "target": "plugin", "versions": "<=4.23.87"}, "RULE-CVE-2026-39478-02": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39478", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.87 unauthenticated/contributor PHP Object Injection via GOTMLS_fix AJAX handler", "mode": "block", "severity": 8.8, "slug": "gotmls", "target": "plugin", "versions": "<=4.23.87"}, "RULE-CVE-2026-39479-01": {"action": "admin_init", "conditions": [{"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via status_filter parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via orderby parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-03": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b|[^A-Z](?:ASC|DESC)[^A-Z].*(?:ASC|DESC|SELECT|SLEEP|BENCHMARK))~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via order parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39480-01": {"ajax_action": "bmip_auth_handshake", "conditions": [{"name": "ARGS:challenge", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39480", "description": "Backup Migration <=2.1.1 unauthenticated sensitive data exposure via bmip_auth_handshake AJAX endpoint", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-39481-01": {"ajax_action": "modula_add_images_ids", "conditions": [{"name": "ARGS:modula_images", "type": "exists"}, {"name": "ARGS:modula_images", "type": "regex", "value": "~(?:O:\\\\d+:\\"|s:\\\\d+:\\\\\\\\?\\"|a:\\\\d+:\\\\{|C:\\\\d+:\\"|r:\\\\d+;)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39481", "description": "Block PHP Object Injection via modula_images parameter in Modula Image Gallery AJAX import handler for users lacking upload_files capability", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.14.18"}, "RULE-CVE-2026-39486-01": {"ajax_action": "dlm_db_log_entries", "conditions": [{"name": "ARGS:dlm_log_orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_db_log_entries AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-02": {"ajax_action": "dlm_alter_download_log", "conditions": [{"name": "ARGS:dlm_upgrade_db", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_alter_download_log AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-03": {"ajax_action": "download_monitor_list_files", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via download_monitor_list_files orderby parameter", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39491-01": {"ajax_action": "jupiterx_custom_snippets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_custom_snippets AJAX handler (title/content/snippet_code)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-02": {"ajax_action": "jupiterx_layout_builder", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_layout_builder AJAX handler (title/layout_data/conditions)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-03": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 stored XSS via raven_form_frontend AJAX handler (fields) - also nopriv", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39492-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:route_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39492", "description": "WP Maps <=4.9.1 unauthenticated SQL injection via route_id in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-39493-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|CONCAT\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39493", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated SQL injection via ssa/v1 REST API", "mode": "block", "severity": 9.3, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39495", "description": "Simply Schedule Appointments <=1.6.9.27 authenticated (Contributor+) SQL injection via REST API", "mode": "block", "severity": 8.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39496-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail/~"}, {"name": "ARGS:email_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via email_type parameter in REST API get_templates endpoint", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-02": {"ajax_action": "yaymail_preview_mail_for_woo", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_preview_mail_for_woo AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-03": {"ajax_action": "yaymail_preview_mail", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_preview_mail AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-04": {"ajax_action": "yaymail_get_template_data_onload", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_get_template_data_onload AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39497-01": {"ajax_action": "woocs_recalculate_order_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_order_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-02": {"ajax_action": "woocs_recalculate_orders_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_orders_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-03": {"ajax_action": "woocs_update_order_rate", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_update_order_rate AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-04": {"ajax_action": "woocs_all_order_ids", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_all_order_ids AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-05": {"ajax_action": "woocs_stat_redraw", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_stat_redraw AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39498-01": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_templates AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import templates endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39498-02": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_state AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import state endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39499-01": {"ajax_action": "wapf_search_products", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39499", "description": "Advanced Product Fields for WooCommerce <=1.6.19 authenticated (Shop Manager+) PHP Object Injection via q parameter in wapf_search_products AJAX handler", "mode": "block", "severity": 7.2, "slug": "advanced-product-fields-for-woocommerce", "target": "plugin", "versions": "<=1.6.19"}, "RULE-CVE-2026-39511-01": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-album", "type": "regex", "value": "~[^0-9\\\\-]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-album parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-02": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-page", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-page parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-03": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-tag", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-tag parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-04": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-search parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39531-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_ne", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_ne parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_sw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_sw parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-03": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via dynamic search field parameters", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39533-01": {"ajax_action": "awpcp_create_empty_listing", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing creation via awpcp_create_empty_listing AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-02": {"ajax_action": "awpcp_save_listing_information", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing modification via awpcp_save_listing_information AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-03": {"ajax_action": "awpcp_update_listing_order", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing order update via awpcp_update_listing_order AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-04": {"ajax_action": "awpcp_update_submit_listing_sections", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing section update via awpcp_update_submit_listing_sections AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39579-01": {"ajax_action": "bblocks_api_keys", "conditions": [{"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39579", "description": "B Blocks <=2.0.31 contributor+ privilege escalation via bblocks_api_keys AJAX handler missing capability check", "mode": "block", "severity": 8.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.31"}, "RULE-CVE-2026-39581-01": {"ajax_action": "activitytime_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-02": {"ajax_action": "activitytime_mvc_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_mvc_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitytime/v1/action(?:/|\\\\?|$)~"}, {"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in REST API activitytime/v1/action endpoint", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39587-01": {"ajax_action": "app_ajax_register", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2026-39587", "description": "Block unauthenticated privilege escalation via app_ajax_register AJAX action in WP BASE Booking plugin <= 5.9.0. Attacker can register a user with an arbitrary role (e.g., administrator) through the unprotected registration handler.", "mode": "block", "severity": 8.1, "slug": "wp-base-booking-of-appointments-services-and-events", "target": "plugin", "versions": "<=5.9.0"}, "RULE-CVE-2026-39589-01": {"ajax_action": "action_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin installation via action_install_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-02": {"ajax_action": "activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin activation via activate_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-03": {"ajax_action": "extras_plugin_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin installation via extras_plugin_install AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-04": {"ajax_action": "extras_plugin_activate", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin activation via extras_plugin_activate AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-05": {"ajax_action": "extras_plugin_update", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin update via extras_plugin_update AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-06": {"ajax_action": "extras_theme_install", "conditions": [{"type": "missing_capability", "value": "install_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme installation via extras_theme_install AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-07": {"ajax_action": "extras_theme_activate", "conditions": [{"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme activation via extras_theme_activate AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-08": {"ajax_action": "extras_theme_update", "conditions": [{"type": "missing_capability", "value": "update_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme update via extras_theme_update AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39591-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via upload.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/uploadFile\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via uploadFile.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload(?:File)?\\\\.php~i"}, {"name": "ARGS:_target", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|[\\\\/]etc[\\\\/]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ path traversal via _target parameter in upload helpers", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39597-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 unauthenticated reflected XSS via posts_data JSON blob in wpz_posts_grid_load_more AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-02": {"ajax_action": "get_content_from_elementor_export_file", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:<script[\\\\s/>]|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via filename parameter (javascript protocol bypass) in get_content_from_elementor_export_file AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-03": {"ajax_action": "get_wpzoom_preview", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|style\\\\s*=)|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via url parameter attribute breakout in get_wpzoom_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39619-01": {"ajax_action": "busiprof_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39619", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39619", "description": "Busiprof <=2.5.2 CSRF to arbitrary plugin install/web shell upload via busiprof_install_activate_plugin AJAX handler", "mode": "block", "severity": 9.6, "slug": "busiprof", "tags": ["csrf", "arbitrary-file-upload", "web-shell", "missing-authorization"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2026-39621-01": {"ajax_action": "spicepress_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "regex", "value": "~^(?!https?://downloads\\\\.wordpress\\\\.org/)~i"}], "cve": "CVE-2026-39621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39621", "description": "SpicePress <=2.3.2.5 CSRF to arbitrary plugin installation via spicepress_install_activate_plugin AJAX handler (missing nonce verification)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "spicepress", "tags": ["csrf", "arbitrary-plugin-installation", "remote-code-execution", "web-shell-upload"], "target": "theme", "versions": "<=2.3.2.5"}, "RULE-CVE-2026-39656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_direct_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_direct_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_reverse_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_reverse_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_settlement_change"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_settlement_change", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_payment_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_payment_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php\\\\?page=sfi_settings~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39665", "description": "SEO Image <=3.0.5 reflected XSS via REQUEST_URI in admin settings page", "mode": "block", "severity": 6.5, "slug": "seo-image", "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-39679-01": {"action": "init", "conditions": [{"name": "ARGS:/style|load_type/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-39679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39679", "description": "Freeio Theme <=1.3.21 local file inclusion via style/load_type parameters in template loading", "method": "GET", "mode": "block", "severity": 7.5, "slug": "freeio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3.21"}, "RULE-CVE-2026-3985-01": {"ajax_action": "ce4wp_abandoned_checkouts_capture_guest_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3985-02": {"ajax_action": "ce4wp_abandoned_checkouts_no_consent_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3986-01": {"action": "admin_init", "conditions": [{"name": "ARGS:form_structure", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3986", "description": "Calculated Fields Form <=5.4.5.0 authenticated (Contributor+) stored XSS via form_structure parameter containing unsanitized fcontent in fhtml field types", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calculated-fields-form", "tags": ["xss", "stored", "authenticated", "insufficient-sanitization"], "target": "plugin", "versions": "<=5.4.5.0"}, "RULE-CVE-2026-4021-01": {"ajax_action": "post_cg1l_login_user_by_key", "conditions": [{"name": "ARGS:cglKey", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4021", "description": "Contest Gallery <=28.1.5 unauthenticated account takeover via post_cg1l_login_user_by_key AJAX action (key-based login after type-confusion activation key overwrite)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=28.1.5"}, "RULE-CVE-2026-4024-01": {"ajax_action": "wpr_update_form_action_meta", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4024", "description": "Royal Elementor Addons <= 1.7.1056 - Unauthenticated Missing Authorization via wpr_update_form_action_meta (post-meta write with publicly-exposed nonce)", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-4029-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-db-backup"}, {"name": "ARGS:action", "type": "equals", "value": "backup"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2026-4029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4029", "description": "WP-DB-Backup <=2.5.2 unauthenticated backup export via admin menu in Multisite", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-01": {"ajax_action": "save_backup_time", "conditions": [{"name": "ARGS:location", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows arbitrary file deletion via location parameter path traversal", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-02": {"action": "init", "conditions": [{"name": "ARGS:via", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on init hook allows arbitrary file read via via parameter path traversal in Multisite", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4031-02": {"ajax_action": "save_backup_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:backup-time", "type": "exists"}], "cve": "CVE-2026-4031", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows subscriber+ schedule manipulation", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4056-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/user-registration/v1/content-access-rules(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4056", "description": "User Registration & Membership <=5.1.4 missing authorization on Content Access Rules REST API allows Contributor+ to create/read/update/delete/toggle/duplicate content restriction rules", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-4059-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[woolentor_quickview_button[^\\\\]]*button_text\\\\s*=\\\\s*(?:\\"|&quot;|&#34;|\')[^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4059", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4059", "description": "ShopLentor <=3.3.5 Contributor+ stored XSS via woolentor_quickview_button shortcode button_text attribute", "mode": "block", "severity": 6.4, "slug": "woolentor-addons", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-4060-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via sort parameter in AJAX query", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4060-02": {"action": "init", "conditions": [{"name": "ARGS:gm_sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via gm_sort front-end parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4061-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:map_post_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-4061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4061", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via map_post_type parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:exclude_object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via exclude_object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids query var in template_redirect handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4066-01": {"ajax_action": "smart-cf-relational-posts-search", "conditions": [{"name": "ARGS:post_types", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-4066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4066", "description": "Smart Custom Fields <=5.0.6 missing per-post authorization in relational posts search allows authenticated users with read capability to enumerate private and draft posts", "mode": "block", "severity": 4.3, "slug": "smart-custom-fields", "tags": ["missing-authorization", "information-disclosure", "ajax"], "target": "plugin", "versions": "<=5.0.6"}, "RULE-CVE-2026-40727-01": {"ajax_action": "bulk_action_listener", "conditions": [{"name": "ARGS:action", "type": "exists"}, {"name": "ARGS:imported", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40727", "description": "Groundhogg <= 4.4 \\u2014 Missing Authorization on Imported File Deletion via bulk_action_listener AJAX (CWE-862)", "mode": "block", "severity": 7.7, "slug": "groundhogg", "target": "plugin", "versions": "<4.4.1"}, "RULE-CVE-2026-40744-01": {"ajax_action": "fl_builder_export_templates_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40744", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40744", "description": "Beaver Builder <=2.10.1.2 authenticated SQL injection via fl_builder_export_templates_data AJAX handler", "mode": "block", "severity": 8.5, "slug": "beaver-builder-lite-version", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=2.10.1.2"}, "RULE-CVE-2026-40745-01": {"ajax_action": "elementpack_dynamic_select_input_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"\']?\\\\d)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-40745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40745", "description": "Element Pack Elementor Addons <=8.4.2 authenticated blind SQL injection via elementpack_dynamic_select_input_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "bdthemes-element-pack-lite", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-40749-01": {"ajax_action": "import_theme_mods", "conditions": [{"name": "FILES:import_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|(?:^|\\\\\\\\.)user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ arbitrary file upload via import_theme_mods AJAX handler \\u2014 blocks dangerous file extensions", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-40749-02": {"ajax_action": "charity_zone_install_and_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ unauthorized plugin installation via charity_zone_install_and_activate_plugin", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-40749-03": {"ajax_action": "tm_install_and_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ unauthorized plugin installation via tm_install_and_activate_plugin", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-40764-01": {"ajax_action": "wpforms_admin_forms_overview_save_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on save_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-02": {"ajax_action": "wpforms_admin_forms_overview_delete_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on delete_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-03": {"ajax_action": "wpforms_update_lite_connect_enabled_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on update_lite_connect_enabled_setting \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-04": {"ajax_action": "wpforms_lite_connect_finalize", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on lite_connect_finalize \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-05": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 missing capability check on lite_settings_upgrade AJAX handler", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40765-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-40765", "description": "Collect.chat <=2.4.9 reflected XSS via REQUEST_URI in admin notice (esc_url bypass)", "mode": "block", "severity": 7.1, "slug": "collectchat", "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-40768-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:fix_booking_id", "type": "regex", "value": "~^[0-9]+$~"}, {"name": "ARGS:new_status", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-40768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40768", "description": "Salon Booking System <=10.30.24 unauthenticated IDOR booking modification via fix_booking_id + new_status on wp_ajax_nopriv_salon (CWE-639)", "mode": "block", "severity": 7.3, "slug": "salon-booking-system", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=10.30.24"}, "RULE-CVE-2026-40769-01": {"ajax_action": "cfefd_remove_file", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^/|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|wp-settings\\\\.php|debug\\\\.log))~i"}], "cve": "CVE-2026-40769", "description": "Contact Form Extender for Divi <=1.0.6 unauthenticated arbitrary file deletion via path traversal in file_name parameter", "mode": "block", "severity": 8.6, "slug": "contact-form-extender-for-divi-builder", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-40770-01": {"ajax_action": "wcusage_floating_widget_content", "conditions": [{"name": "ARGS:wcusage_floating_widget_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated XSS via wcusage_floating_widget_content AJAX handler", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-02": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:coupon_code", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via coupon_code in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-03": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:user", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via user parameter in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-04": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:wcu-input-username", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via wcu-input-username in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40771-01": {"ajax_action": "post_cg_galleries_show_cg_gallery", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_galleries_show_cg_gallery AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40771-02": {"ajax_action": "post_cg_load_v10", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_load_v10 AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40775-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/site(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 unauthenticated broken access control on REST API route /site", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/(?:posts|pages|media|search)(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 unauthenticated broken access control on REST API content routes (posts, pages, media, search)", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-04": {"ajax_action": "royal_mcp_get_platform_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 missing authorization on royal_mcp_get_platform_fields AJAX handler", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-05": {"ajax_action": "royal_mcp_test_connection", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 missing authorization on royal_mcp_test_connection AJAX handler", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40779-01": {"action": "save_link_library_moderate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40779", "description": "Link Library <=7.8.8 contributor+ arbitrary file deletion via admin_post_save_link_library_moderate (missing capability check on moderation handler)", "mode": "block", "severity": 7.7, "slug": "link-library", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=7.8.8"}, "RULE-CVE-2026-40780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v[0-9]+/(?:[^/]*(?:password|reset|recover|forgot|auth)[^/]*)(?:/|\\\\?|$)~i"}, {"name": "ARGS:email", "type": "regex", "value": "~.+@.+~"}], "cve": "CVE-2026-40780", "description": "BookIt <2.5.4.1 unauthenticated authentication bypass via REST API password recovery exploitation", "mode": "block", "severity": 7.5, "slug": "bookit", "target": "plugin", "versions": "<2.5.4.1"}, "RULE-CVE-2026-40784-01": {"ajax_action": "fluentform_fluent_board_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40784", "description": "FluentBoards <=1.91.2 IDOR via fluentform_fluent_board_config AJAX handler missing authorization", "mode": "block", "severity": 8.1, "slug": "fluent-boards", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.91.2"}, "RULE-CVE-2026-40787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quiz/(?:save_quiz|create_quiz)~"}, {"name": "ARGS:quiz_name", "type": "exists"}, {"name": "ARGS:quiz_name", "type": "regex", "value": "~(?:<[a-z/!?]|[\\"\']\\\\s*(?:on[a-z]+=|style\\\\s*=|xmlns)|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40787", "description": "Stored XSS in Quiz And Survey Master <= 11.0.0 via quiz name/description fields in REST API save_quiz/create_quiz endpoints \\u2014 blocks HTML/script injection patterns in quiz_name parameter for users lacking manage_options", "mode": "block", "severity": 7.1, "slug": "quiz-master-next", "target": "plugin", "versions": "<=11.0.0"}, "RULE-CVE-2026-40791-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:from_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via from_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40791-02": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:test_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via test_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40797-01": {"ajax_action": "date_change_on_no", "conditions": [{"name": "ARGS:wi_webinar_id_resend_mail", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via wi_webinar_id_resend_mail in date_change_on_no AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-02": {"ajax_action": "webinarignition_broadcast_msg_poll", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via id in webinarignition_broadcast_msg_poll AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-03": {"ajax_action": "webinarignition_send_email_verification_code", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via email in webinarignition_send_email_verification_code AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40798-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\'\\\\s*(?:AND|OR)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\'\\\\s*(?:AND|OR)\\\\s+.*(?:SELECT|UNION|CONCAT|VERSION|DATABASE))~i"}], "cve": "CVE-2026-40798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40798", "description": "wpForo Forum <=3.0.4 unauthenticated SQL injection via q parameter in wpforo_tag_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-4087-01": {"ajax_action": "pprh_update_hints", "conditions": [{"name": "ARGS:pprh_data", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4087", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4087", "description": "Pre* Party Resource Hints <=1.8.20 authenticated (Subscriber+) SQL injection via hint_ids in pprh_data JSON parameter", "mode": "block", "severity": 6.5, "slug": "pre-party-browser-hints", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.20"}, "RULE-CVE-2026-4094-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woocs_reset", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4094", "description": "FOX Currency Switcher <=1.4.5 missing authorization allows authenticated users to delete plugin configuration via woocs_reset parameter on admin pages", "mode": "block", "severity": 8.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-4100-02": {"ajax_action": "pmpro_stripe_delete_webhook", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^pmpro_stripe_delete_webhook$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4100", "description": "Paid Memberships Pro <=3.6.5 missing authorization on pmpro_stripe_delete_webhook allows authenticated Subscriber+ users to delete Stripe webhooks and disrupt payment processing", "mode": "block", "severity": 7.1, "slug": "paid-memberships-pro", "tags": ["missing-authorization", "service-disruption"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-4127-01": {"ajax_action": "speedup01_enabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_enabled allows subscriber+ to toggle optimization settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "speedup-optimization", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4127-02": {"ajax_action": "speedup01_purge_all", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_purge_all allows subscriber+ to purge all cache files", "method": "POST", "mode": "block", "severity": 7.5, "slug": "speedup-optimization", "tags": ["missing-authorization", "cache-purge", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4132-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_htpasswd_path", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp[x]?|jsp[x]?|cfm)|[\\\\\\\\/]\\\\.(?:htaccess|user\\\\.ini)(?:$|[\\\\s?#])~i"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via dangerous file extension in hh_htpasswd_path", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "path-traversal"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4132-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_htpasswd_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via path traversal in hh_htpasswd_path", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "path-traversal"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4132-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_www_authenticate_user", "type": "regex", "value": "~(?:^|[;{(\\\\s])<\\\\?(?:php|=|\\\\s)|(?:^|[;{(\\\\s])<%(?![a-z])~i"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via PHP code injection in hh_www_authenticate_user", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4143-01": {"ajax_action": "fakturama", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4143", "description": "Neos Connector for Fakturama <=0.0.14 fully unprotected AJAX handler allows CSRF via wp_ajax_fakturama", "mode": "block", "severity": 4.3, "slug": "neos-connector-for-fakturama", "target": "plugin", "versions": "<=0.0.14"}, "RULE-CVE-2026-4146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=loco-version(?:&|$)~"}, {"name": "ARGS:update_href", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:[^,]*(?:text/html|base64)|[\\"\'><]|on(?:error|load|click|mouseover|focus)\\\\s*=|%(?:22|27|3[CEce]))~i"}], "cve": "CVE-2026-4146", "description": "Loco Translate <=2.8.2 reflected XSS via update_href parameter on admin version page", "mode": "block", "severity": 6.1, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2026-42379-04": {"ajax_action": "templately_save_conditions", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "templately_save_conditions"}, {"name": "ARGS:conditions", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42379", "description": "Templately <=3.6.1 unauthorized condition saving via templately_save_conditions AJAX handler missing capability check", "mode": "block", "severity": 7.7, "slug": "templately", "tags": ["missing-authorization", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-42384-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/(?:debug|logs?)(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42384", "description": "Simply Schedule Appointments <1.6.11.2 unauthenticated debug log exposure via REST API (ssa/v1 debug endpoint)", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "target": "plugin", "versions": "<1.6.11.2"}, "RULE-CVE-2026-4248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\{usermeta:[^}]*(?:password_reset_link|user_pass|session_tokens|user_activation_key)[^}]*\\\\}~i"}], "cve": "CVE-2026-4248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4248", "description": "Ultimate Member <=2.11.2 authenticated (Contributor+) sensitive usermeta disclosure via {usermeta:} placeholder in post content", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ultimate-member", "tags": ["insecure-direct-object-reference", "sensitive-data-exposure", "stored-content"], "target": "plugin", "versions": "<=2.11.2"}, "RULE-CVE-2026-4261-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:on_expire_default_to_role", "type": "regex", "value": "~^(?i)(?:administrator|editor|author|contributor)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4261", "description": "Expire Users <=1.2.2 authenticated privilege escalation via profile on_expire_default_to_role parameter", "mode": "block", "severity": 8.8, "slug": "expire-users", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-42649-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "favicon-rotator"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc](?:script|svg|img|iframe|object|embed|body)|(?:^|[^a-z])on(?:error|load|focus|click|mouseover|blur)(?:%3[Dd]|\\\\s*=)|javascript(?:%3[Aa]|\\\\s*:)|<(?:script|svg|img|iframe|object|embed|body)[\\\\s/>])~i"}], "cve": "CVE-2026-42649", "description": "Favicon Rotator <=1.2.11 unauthenticated reflected XSS via unsanitized REQUEST_URI on admin settings page", "mode": "block", "severity": 7.1, "slug": "favicon-rotator", "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2026-42650-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-03": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-04": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42652-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "user-registration-membership-payment-history"}, {"name": "ARGS:action", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]+[^a-zA-Z0-9_]on(?:cl|er|lo|fo|pu)\\\\w*\\\\s*=|[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]\\\\s*:)~i"}], "cve": "CVE-2026-42652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42652", "description": "User Registration <=5.1.5 reflected XSS via action parameter on payment history admin page", "mode": "block", "severity": 7.1, "slug": "user-registration", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=5.1.5"}, "RULE-CVE-2026-42665-01": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via order parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-02": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via orderby parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-03": {"ajax_action": "wpda_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via wpda_autocomplete AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42667-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42667", "description": "Bookly <=27.4 unauthenticated sensitive data exposure via bookly_speed_up_update_addons AJAX handler", "mode": "block", "severity": 7.5, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.4"}, "RULE-CVE-2026-42668-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/connect(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST connect endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/disconnect-current-site(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST disconnect endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/omnisend-settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST settings endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42678-01": {"ajax_action": "give_get_content_by_ajax", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?iframe[\\\\s>]|<svg[\\\\s/]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-42678", "description": "GiveWP <=4.14.5 authenticated reflected XSS via url parameter in give_get_content_by_ajax AJAX handler", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.5"}, "RULE-CVE-2026-42684-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-03": {"ajax_action": "wpjobportal_ajax_popup_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup_action AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-04": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_loginwith_ajax social login handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42685-01": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS:wpjobportal-social/[a-z]+/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-42685", "description": "WP Job Portal <=2.5.1 unauthenticated reflected XSS via social login parameters in wpjobportal_loginwith_ajax", "mode": "block", "severity": 7.1, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42687-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2026-42687", "description": "EventPrime <=4.3.2.1 unauthenticated PHP Object Injection via unserialize of raw request body in eventprime_api AJAX handler", "mode": "block", "severity": 8.1, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.2.1"}, "RULE-CVE-2026-42727-01": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_table_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-02": {"ajax_action": "woot_get_columns_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 subscriber+ blind SQL injection via table_html_id in woot_get_columns_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-03": {"ajax_action": "woot_get_smth", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_smth", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42734-01": {"ajax_action": "geo_mashup_kml_attachments", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_kml_attachments", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42734-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_query", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42742-01": {"ajax_action": "_review_action", "conditions": [{"name": "ARGS:view_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\\\\bIF\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\s+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42742", "description": "Views for WPForms Lite <=3.4.6 authenticated blind SQL injection via view_id in _review_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "views-for-wpforms-lite", "tags": ["sql-injection", "blind-sql", "missing-authorization"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-42754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "realfavicongenerator"}, {"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\bon(?:load|error|click|mouse\\\\w+|focus|blur|key\\\\w+|submit)\\\\s*=|<script[^>]*>|javascript\\\\s*:|<(?:iframe|object|embed|svg)[^>]*>~i"}], "cve": "CVE-2026-42754", "description": "Favicon by RealFaviconGenerator <=1.3.46 reflected XSS via query parameters in admin appearance view", "mode": "block", "severity": 7.1, "slug": "favicon-by-realfavicongenerator", "target": "plugin", "versions": "<=1.3.46"}, "RULE-CVE-2026-42756-01": {"ajax_action": "undo_single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in undo_single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-02": {"ajax_action": "single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-03": {"ajax_action": "image_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in image_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42761-02": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^woot_get_table_data$~i"}, {"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:\\\\b(?:UNION(?:\\\\s+ALL)?\\\\s+SELECT|(?:AND|OR)\\\\s+(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|[0-9]{1,6}\\\\s*[=<>]+\\\\s*[0-9]{1,6}|[A-Z0-9_]{1,32}\\\\s*=\\\\s*[\'\\"][^\'\\"]{0,32}[\'\\"]))\\\\b|--[ \\\\t]*$|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}], "cve": "CVE-2026-42761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42761", "description": "Active Products Tables for WooCommerce <=1.0.9 unauthenticated blind SQL injection via table_html_id in woot_get_table_data AJAX handler", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2026-42775-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via orderby parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-42775-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via order parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-4283-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "super-unsubscribe"}, {"name": "ARGS:process_now", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4283", "description": "WP DSGVO Tools (GDPR) <=3.1.38 unauthenticated account destruction via super-unsubscribe process_now branch", "mode": "block", "severity": 9.1, "slug": "shapepress-dsgvo", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "account-destruction"], "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2026-4300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "rbs_gallery_options_loading"}, {"name": "ARGS:rsg_LoadingWord", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|body|iframe|object|embed|div|input|form|style|link|meta|audio|video|source|details|marquee)[\\\\s/>]|<[^>]+\\\\son[a-z]+\\\\s*=|javascript\\\\s*:|%3[Cc]\\\\s*(?:script|svg|img|body|iframe|div|input))~i"}], "cve": "CVE-2026-4300", "description": "Robo Gallery <=5.1.3 authenticated stored XSS via rsg_LoadingWord on rbs_gallery_options_loading settings page", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2026-4302-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optn/v1/integration-action(/|\\\\?|$)~"}, {"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|0[.]|0x|\\\\[[:0-9a-fA-F]|localhost))|(?:^(?:gopher|file|dict|ftp|telnet|ldap)://)~i"}], "cve": "CVE-2026-4302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4302", "description": "Optin (optin) <=1.4.29 unauthenticated SSRF via REST API optn/v1/integration-action link parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "optin", "tags": ["ssrf", "unauthenticated", "rest-api", "cwe-918"], "target": "plugin", "versions": "<=1.4.29"}, "RULE-CVE-2026-4303-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through post editor", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4303-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through REST API posts endpoint", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4306-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "getNextJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+=\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4306-02": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:task", "type": "equals", "value": "getNextTemplateJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:\\\\bUNION\\\\b\\\\s+(?:\\\\bALL\\\\b\\\\s+)?\\\\bSELECT\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|/\\\\*[^*]*\\\\*+(?:[^/*][^*]*\\\\*+)*/|(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextTemplateJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4326-01": {"ajax_action": "afeb_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-4326", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4326", "description": "Vertex Addons for Elementor <=1.6.4 missing authorization on afeb_activate_required_plugins allows subscriber+ arbitrary plugin installation", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor-builder", "tags": ["missing-authorization", "arbitrary-plugin-installation", "privilege-escalation"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2026-4328-01": {"ajax_action": "demo_download_and_unzip", "conditions": [{"name": "ARGS:demo_file_type", "type": "equals", "value": "url"}, {"name": "ARGS:demo_file", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|ssh2?|telnet|tftp|expect|glob|phar|php|zip|rar|data|ogg|compress\\\\.zlib)\\\\s*:|(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.[0-9]|10\\\\.[0-9]|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|0177\\\\.|0x7f)(?:[:/]|$))~i"}], "cve": "CVE-2026-4328", "description": "Advanced Import <=1.4.6 authenticated SSRF via demo_file parameter in demo_download_and_unzip AJAX handler", "mode": "block", "severity": 6.4, "slug": "advanced-import", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-4329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4329", "description": "Blackhole Bad Bots <=3.8 stored XSS via unescaped bot log data on admin settings page", "mode": "block", "severity": 7.2, "slug": "blackhole-bad-bots", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.8"}, "RULE-CVE-2026-4331-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "b2s_reset_social_meta_tags"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4331", "description": "Blog2Social <=8.8.2 missing authorization on b2s_reset_social_meta_tags allows subscriber+ deletion of all social meta data", "mode": "block", "severity": 4.3, "slug": "blog2social", "tags": ["missing-authorization", "data-deletion", "authenticated"], "target": "plugin", "versions": "<=8.8.2"}, "RULE-CVE-2026-4333-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4333-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4335-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/[0-9]+~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter|move)|load|error|keydown|keyup|change|input|submit|reset|drag|drop|pointer(?:down|up|enter|leave))\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4335", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4335", "description": "ShortPixel Image Optimizer <=6.4.3 Author+ stored XSS via attachment post_title rendered unescaped in AI editor popup", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2026-4336-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/ufaq(?:$|[/?]|\\\\?.*)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:script\\\\b[^>]*>.*?</script\\\\s*>|[^>]+\\\\bon(?:click|load|error|mouseover|focus|blur)\\\\s*=|a\\\\b[^>]+\\\\bhref\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|img\\\\b[^>]+\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~is"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ content submitted to REST API /wp/v2/ufaq", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "ufaq"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[ />]|<[^>]+on(?:click|load|error|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&lt;script|&lt;[^&]*on(?:click|load|error|mouseover|focus|blur)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ post_content submitted through wp-admin/post.php editor", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4338-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitypub/1\\\\.0/outbox(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4338", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4338", "description": "ActivityPub <8.0.2 unauthenticated information disclosure of draft/scheduled/pending posts via site-level outbox REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "activitypub", "tags": ["information-disclosure", "rest-api", "unauthenticated", "improper-access-control"], "target": "plugin", "versions": "<8.0.2"}, "RULE-CVE-2026-4341-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:actions", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor AJAX save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor REST save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4347-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via file upload move flow (generate_user_filepath / move_temp_file_to_upload_dir)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4347-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|phs|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via crafted uploaded filename in file field", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4365-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "delete_question_answer"}, {"type": "missing_capability", "value": "edit_lp_courses"}], "cve": "CVE-2026-4365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4365", "description": "LearnPress <=4.3.2.8 unauthenticated arbitrary quiz answer deletion via lp-ajax delete_question_answer", "method": "POST", "mode": "block", "severity": 9.1, "slug": "learnpress", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-4373-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-02": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in post.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4388-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in fm_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4388-02": {"action": "init", "conditions": [{"name": "ARGS:fm_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in non-AJAX form submission", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through REST API wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4484-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/masteriyo/v1/users/instructors/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:roles", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4484", "description": "Masteriyo LMS <=2.1.6 authenticated (Student+) privilege escalation to administrator via roles parameter in instructors REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2026-45218-01": {"action": "wp_ajax_nopriv_wp_travel_update_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_update_trip unauthenticated endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-02": {"action": "wp_ajax_nopriv_wp_travel_get_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_trip without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-03": {"action": "wp_ajax_wp_travel_get_pricings", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_pricings without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-04": {"action": "wp_ajax_nopriv_wptravel_save_user_enquiry", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wptravel_save_user_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-05": {"action": "wp_ajax_nopriv_wp_travel_add_to_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_add_to_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-06": {"action": "wp_ajax_nopriv_wp_travel_get_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-07": {"action": "wp_ajax_delete_itinerary_enquiry", "conditions": [{"name": "ARGS:enquiry_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via delete_itinerary_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45437-01": {"ajax_action": "eszlwcf_filter_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_filter_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45437-02": {"ajax_action": "eszlwcf_load_more_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_load_more_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45439-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:import)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API import endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-45439-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:update)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API update endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4561-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:/text_subscribed|text_error/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|mouseleave|focus|blur)\\\\s*=|(?:javascript|data)\\\\s*:)~i"}], "cve": "CVE-2026-4561", "description": "MC4WP Mailchimp for WordPress <=4.12.0 Author+ stored XSS via text_subscribed/text_error form message post meta", "mode": "block", "slug": "mailchimp-for-wp", "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-4655-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:options", "type": "regex", "value": "~bdt-svg-image~i"}, {"name": "ARGS:options", "type": "regex", "value": "~(?:%3C|<)\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*(?:=|%3D)|javascript\\\\s*(?::|%3A)|%253[Cc]script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4655", "description": "Element Pack Lite <=8.4.2 contributor+ stored XSS via SVG Image widget svg_source on elementor_ajax", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block class attributes (REST post save - className)", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4658-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~wp:essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&quot;javascript)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block markup in any request body", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4659-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]+){2,}|/etc/passwd|[/\\\\\\\\](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-4659", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4659", "description": "Unlimited Elements for Elementor <=2.0.6 authenticated contributor+ arbitrary file read via path traversal in Repeater JSON/CSV URL within Elementor widget settings", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-4664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ivole/v1/review(?:[/?&]|$)~"}, {"name": "ARGS:key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-4664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4664", "description": "Customer Reviews for WooCommerce <=5.103.0 unauthenticated authentication bypass on POST /ivole/v1/review via empty key parameter against ivole_secret_key meta", "method": "POST", "mode": "block", "severity": 5.3, "slug": "customer-reviews-woocommerce", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.103.0"}, "RULE-CVE-2026-4665-01": {"ajax_action": "wpcf_image_save_meta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*\\\\son(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-4665", "description": "WP Carousel Free <=2.7.10 stored DOM XSS via crafted data-caption in wpcf_image_save_meta AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2026-4665-02": {"ajax_action": "wpcp_import_shortcodes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*\\\\son(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-4665", "description": "WP Carousel Free <=2.7.10 stored DOM XSS via shortcodes import containing malicious data-caption payloads", "mode": "block", "severity": 6.4, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2026-4703-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-4703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4703", "description": "WS Form LITE <=1.10.80 unauthenticated PHP object injection via unsafe deserialization of form submission meta values", "mode": "block", "severity": 9.8, "slug": "ws-form", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.10.80"}, "RULE-CVE-2026-4758-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4758-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax_popup", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (post.php save)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (heartbeat autosave)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (REST API)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4790-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:custom_svg", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|animationstart|animationend)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4790", "description": "Premium Addons for Elementor <=4.11.70 contributor+ stored XSS via custom_svg parameter (CWE-79)", "mode": "block", "severity": 5.4, "slug": "premium-addons-for-elementor", "target": "plugin", "versions": "<=4.11.70"}, "RULE-CVE-2026-4801-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?(?:icalFeedUrl|eventsTitle|eventsDescription|eventsLocation)[\\\\s\\\\S]*?<[^>]+(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed attributes in Gutenberg REST API", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4801-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?icalFeedUrl[\\\\s\\\\S]*?(?:javascript\\\\s*:|<[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed URL attribute", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4812-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/post_object/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated post_object enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/relationship/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated relationship enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/page_link/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated page_link enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/user/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated user enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/select/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated select enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/taxonomy/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated taxonomy enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4817-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s+(?:UNION|SELECT|DROP|DELETE|INSERT|UPDATE|TABLE|INTO|VALUES|FROM|WHERE|version)\\\\s)~i"}], "cve": "CVE-2026-4817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4817", "description": "MasterStudy LMS <=3.7.25 SQL injection via orderby parameter in stm-lms/order/items REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.25"}, "RULE-CVE-2026-4880-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "barcodeScannerConfigs"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX action (GET or POST)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-02": {"ajax_action": "setUserMeta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via setUserMeta AJAX action (wp_capabilities)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]action=barcodeScannerConfigs(?:&|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX GET request (REQUEST_URI detection)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]barcode-scanner-lite-pos-to-manage-products-inventory-and-orders[/\\\\\\\\]request\\\\.php~"}, {"name": "ARGS:route", "type": "equals", "value": "setUserMeta"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via direct request.php setUserMeta endpoint (wp_capabilities)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-48835-01": {"ajax_action": "wpforms_connect_process", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48835", "description": "WPForms Lite <=1.10.0.4 unauthenticated broken access control via wpforms_connect_process AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.10.0.4"}, "RULE-CVE-2026-48874-01": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via orderby in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48874-02": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via order in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48876-01": {"ajax_action": "sfs_sub", "conditions": [{"name": "ARGS:comment_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via comment_id in sfs_sub AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-02": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via ip parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-03": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:func", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via func parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-04": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:cont", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via cont parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-05": {"action": "init", "conditions": [{"name": "ARGS:ocimg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via ocimg parameter in kpg_ss_init hook", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48882-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48882", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-48882", "description": "WP Time Slots Booking Form <=1.2.50 subscriber+ SQL injection via wpts_run_email_diagnostic AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-time-slots-booking-form", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.50"}, "RULE-CVE-2026-4896-01": {"ajax_action": "delete_wcfm_product", "conditions": [{"name": "ARGS:proid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_product allows authenticated users to delete arbitrary products without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-02": {"ajax_action": "delete_wcfm_article", "conditions": [{"name": "ARGS:articleid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_article allows authenticated users to delete arbitrary articles without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-03": {"ajax_action": "wcfm_modify_order_status", "conditions": [{"name": "ARGS:orderid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on wcfm_modify_order_status allows authenticated users to modify status of arbitrary orders without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-48964-01": {"ajax_action": "eh_crm_settings_initiate_ticket", "conditions": [{"name": "ARGS:start_number", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d+\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-48964", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.6 authenticated SQL injection via start_number in eh_crm_settings_initiate_ticket AJAX handler", "mode": "block", "severity": 8.5, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.6"}, "RULE-CVE-2026-48968-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_params in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_id in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via orderby in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via order in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-49044-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "acffa_settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-49044", "description": "Advanced Custom Fields: Font Awesome Field <=5.0.2 authenticated stored XSS via acffa_settings option values", "mode": "block", "severity": 6.5, "slug": "advanced-custom-fields-font-awesome", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-49055-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated reflected XSS via path parameter in dnd_codedropz_upload_delete", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49055-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "FILES:upload-file:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated stored XSS via uploaded filename in dnd_codedropz_upload", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49060-01": {"ajax_action": "hippoo_save_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_save_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49060-02": {"ajax_action": "hippoo_add_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_add_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49060-03": {"ajax_action": "hippoo_delete_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_delete_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49063-01": {"ajax_action": "lsd_register", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_register (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-02": {"ajax_action": "lsd_login", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_login (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-03": {"ajax_action": "lsd_activation", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Authenticated Privilege Escalation via lsd_activation (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49067-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^yydev[_-]redirect~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-49067", "description": "Advanced 301 and 302 Redirect <=1.6.9 unauthenticated SQL injection via id parameter on admin page endpoint", "mode": "block", "severity": 9.3, "slug": "advanced-301-and-302-redirect", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-49069-01": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via taxonomy parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-02": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:term", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via term parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-03": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via orderby parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-04": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via order parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49085-01": {"action": "init", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~Tzo|Qzo~"}], "cve": "CVE-2026-49085", "description": "WP Insightly for CF7 <=1.1.4 unauthenticated PHP object injection via base64-encoded data parameter", "mode": "block", "severity": 9.8, "slug": "cf7-insightly", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-49104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\{]~"}], "cve": "CVE-2026-49104", "description": "Integration for Keap/Infusionsoft and Contact Form 7 <=1.2.1 unauthenticated PHP object injection via CF7 form field deserialization", "mode": "block", "severity": 9.8, "slug": "cf7-infusionsoft", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-49106-01": {"ajax_action": "get_objects_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_objects_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49106-02": {"ajax_action": "get_field_map_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_field_map_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49112-01": {"action": "init", "conditions": [{"name": "ARGS:_sf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal via _sf_file query var leading to arbitrary file read", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-49112-02": {"action": "init", "conditions": [{"name": "ARGS:_SF_GOTO", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|https?://(?!(?:[a-z0-9-]+\\\\.)*(?:wordpress\\\\.org|w\\\\.org)(?:[/?#]|$)))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal/open redirect via _SF_GOTO query var", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-4935-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "suretriggers-status"}, {"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4935", "description": "SureTriggers <=1.1.22 authenticated SQL injection via status_filter parameter", "mode": "block", "severity": 8.6, "slug": "suretriggers", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.1.22"}, "RULE-CVE-2026-49763-01": {"action": "init", "conditions": [{"name": "ARGS:code", "type": "exists"}, {"name": "ARGS:state", "type": "regex", "value": "~(?:%(?:4[Ff]|6[Ff]|43|63|61|41)|[OCa])(?:%3[Aa]|:)[0-9]~i"}], "cve": "CVE-2026-49763", "description": "Integration for Contact Form 7 HubSpot <=1.3.7 unauthenticated PHP Object Injection via state parameter in OAuth callback", "mode": "block", "severity": 9.8, "slug": "cf7-hubspot", "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2026-49764-01": {"ajax_action": "rm_activate_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_activate_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49764-02": {"ajax_action": "rm_login_social_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_login_social_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49765-01": {"action": "init", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - PHP Object Injection via vx_data on init hook (unauthenticated)", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49765-02": {"ajax_action": "update_feed_mc", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - Authenticated PHP Object Injection via vx_data in update_feed_mc AJAX handler", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49766-01": {"action": "init", "conditions": [{"name": "ARGS:current_user_avatar", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_avatar", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49766-02": {"action": "init", "conditions": [{"name": "ARGS:current_user_cover", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_cover", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49767-01": {"ajax_action": "wpforo_confirm_current_user_password", "conditions": [{"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-49767", "description": "wpForo Forum <=3.1.0 unauthenticated broken authentication via wpforo_confirm_current_user_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49769-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49769", "description": "wpForo Forum <=3.1.0 unauthenticated PHP Object Injection via serialized parameter", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49770-01": {"ajax_action": "wte_onboard_dynamic_recommendation", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_onboard_dynamic_recommendation AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-02": {"ajax_action": "email_test", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via email_test AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-03": {"ajax_action": "wte_fxn_clone_trip_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_fxn_clone_trip_data AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-04": {"ajax_action": "wptravelengine_send_test_email", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wptravelengine_send_test_email AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49771-01": {"ajax_action": "bwg_frontend_data", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in bwg_frontend_data AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49771-02": {"ajax_action": "GalleryBox", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in GalleryBox AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49772-01": {"action": "init", "conditions": [{"name": "ARGS:event_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 unauthenticated blind SQL injection via event_ids parameter on attendee registration page", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49772-02": {"ajax_action": "tec_qr_code_modal", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 authenticated blind SQL injection via post_id in tec_qr_code_modal AJAX handler", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49774-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:rd_station_form_identifier", "type": "exists"}, {"name": "ARGS:rd_station_form_identifier", "type": "regex", "value": "~(?:php://|data://|phar://|expect://|glob://|(?:\\\\.\\\\.[\\\\\\\\/]){2,}|<script[\\\\s/>]|javascript\\\\s*:|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 stored code injection via rd_station_form_identifier metabox field blocked for users lacking edit_others_posts capability", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-02": {"ajax_action": "rd-persist-tokens", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rd-persist-tokens AJAX handler (CWE-862)", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-03": {"ajax_action": "rd-persist-legacy-tokens", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rd-persist-legacy-tokens AJAX handler (CWE-862)", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-04": {"ajax_action": "rdsm-disconnect-oauth", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-disconnect-oauth AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-05": {"ajax_action": "rdsm-update-tracking-code-status", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-update-tracking-code-status AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-08": {"ajax_action": "rdsm-authorization-check", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-authorization-check AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-09": {"ajax_action": "rdsm-custom-fields", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-custom-fields AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-49776", "description": "GPTranslate <=2.32.6 unauthenticated SQL injection via id parameter in gptranslate/v1/request REST endpoint", "mode": "block", "severity": 9.3, "slug": "gptranslate", "target": "plugin", "versions": "<=2.32.6"}, "RULE-CVE-2026-49781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/suretriggers/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49781", "description": "OttoKit (SureTriggers) <=1.1.27 unauthenticated PHP object injection via REST API", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2026-4987-01": {"ajax_action": "srfm_create_payment_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_payment_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4987-02": {"ajax_action": "srfm_create_subscription_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_subscription_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-5127-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpuf_submit_post"}, {"name": "ARGS:wpuf_files", "type": "regex", "value": "~(?:^|[^a-zA-Z0-9])(?:O|C|a):[0-9]+:(?:\\"|%22|%2522)~i"}], "cve": "CVE-2026-5127", "description": "WP User Frontend <=4.3.1 PHP object injection via wpuf_files parameter on admin-ajax.php action=wpuf_submit_post", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-5149-01": {"ajax_action": "get_submission_content", "conditions": [{"name": "ARGS:entries_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5149", "description": "RTMKit <=2.0.7 missing authorization on get_submission_content allows contributor+ to view arbitrary form submissions via entries_id IDOR", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-5159-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/(?:admin-ajax\\\\.php|post\\\\.php|admin-post\\\\.php)~i"}, {"name": "ARGS", "type": "regex", "value": "~instagram_follow_text[\\"\'\\\\\\\\\\\\s:]+[^\\"\']*(?:<[a-zA-Z/!]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-5159", "description": "Royal Elementor Addons <=1.7.1056 Contributor+ stored XSS via Instagram Feed widget instagram_follow_text setting", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5162-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:elementor_data", "type": "regex", "value": "~instagram_follow_text[^}]{0,4000}?(?:<(?:\\\\\\\\?/?)?(?:script[\\\\s/>]|iframe|object|embed|applet|svg|img\\\\b)|on(?:error|load|click|mouseover|mouseout|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5162", "description": "Royal Elementor Addons <=1.7.1056 stored XSS via instagram_follow_text in Instagram Feed widget", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5192-01": {"ajax_action": "forminator_submit_form_cform", "conditions": [{"name": "ARGS:upload-1[file][file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via upload-1[file][file_path] in form submit AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5192-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS:file_data[file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via file_data[file_path] in multiple file upload AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5200-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "acymailing_router"}, {"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5200", "description": "AcyMailing <=10.8.2 missing authorization on acymailing_router allows authenticated subscriber+ privilege escalation", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=10.8.2"}, "RULE-CVE-2026-5207-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (AJAX vector)", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5207-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "llms-reporting"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (admin page vector)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5229-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/form-notify/v1/callback(?:[/?]|$)~"}, {"name": "REQUEST_COOKIES:form_notify_line_email", "type": "exists"}], "cve": "CVE-2026-5229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5229", "description": "Form Notify <=1.1.10 unauthenticated authentication bypass via form_notify_line_email cookie on LINE OAuth callback", "mode": "block", "severity": 9.8, "slug": "form-notify", "tags": ["authentication-bypass", "improper-authentication", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-5231-01": {"action": "admin_init", "conditions": [{"name": "ARGS:tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-z]+=|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5231", "description": "WP Statistics <=14.16.4 reflected XSS via unsanitized tab parameter in admin template", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "reflected", "admin-template"], "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-52693-01": {"ajax_action": "get_viariation_details", "conditions": [{"name": "ARGS:cart_content[/\\\\d+/]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via cart_content in get_viariation_details AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52693-02": {"ajax_action": "shopping_cart_products", "conditions": [{"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via raw parameter in shopping_cart_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52694-01": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:invitation", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~i"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive data exposure via document and invitation parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-02": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:download", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive document download via document and download parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-03": {"ajax_action": "esig_create_order_agreement", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 missing authorization on esig_create_order_agreement AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52697-01": {"ajax_action": "wppm_filter_autocomplete", "conditions": [{"name": "ARGS:project_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_search in wppm_filter_autocomplete AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:project_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_id in wppm_get_project_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-03": {"ajax_action": "wppm_get_task_list", "conditions": [{"name": "ARGS:task_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via task_id in wppm_get_task_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-04": {"ajax_action": "wppm_edit_task_status", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via id parameter in wppm_edit_task_status AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-05": {"ajax_action": "wppm_get_task_list_card_view", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via page_no in wppm_get_task_list_card_view AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-06": {"ajax_action": "wppm_drag_and_drop_card", "conditions": [{"name": "ARGS:proj_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via proj_ids in wppm_drag_and_drop_card AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52702-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-redirection.php"}, {"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3Cscript|%3[Ee]|<img[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 unauthenticated reflected XSS via redirect_from parameter on admin page", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52702-02": {"ajax_action": "customAddUpdate", "conditions": [{"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:\'|%27)\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 authenticated SQL injection via redirect_from in customAddUpdate AJAX handler", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/download(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/download REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/view-log(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/view-log REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via template/directory-tree REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5294-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5294", "description": "Geeky Bot <=1.2.2 unauthenticated arbitrary plugin installation via geekybot_frontendajax AJAX handler", "mode": "block", "severity": 9.8, "slug": "geeky-bot", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-5324-01": {"ajax_action": "brizy_form_submit", "conditions": [{"name": "ARGS:data[fields][FileUpload]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5324", "description": "Brizy \\u2013 Page Builder <=2.8.11 unauthenticated stored XSS via form submission FileUpload field value", "mode": "block", "severity": 7.2, "slug": "brizy", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2026-5364-01": {"ajax_action": "cf7_file_uploads", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:^|\\\\|)\\\\s*(?:ph(?:p[2-9s]?|tml?|ar)|s?html?|cgi|aspx?|jspx?|cfm|htaccess|user\\\\.ini)\\\\s*(?:\\\\||$)~i"}], "cve": "CVE-2026-5364", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5364", "description": "Drag and Drop File Upload for Contact Form 7 <=1.1.3 unauthenticated arbitrary PHP file upload via extension validation bypass in cf7_file_uploads AJAX handler", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-file-upload-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "extension-bypass"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2026-5371-01": {"ajax_action": "monsterinsights_ads_get_token", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google OAuth access tokens via monsterinsights_ads_get_token AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "oauth-token-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-02": {"ajax_action": "monsterinsights_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized reset of Google Ads integration via monsterinsights_ads_reset_experience AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "integration-reset"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-03": {"ajax_action": "monsterinsights_ads_get_settings", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google Ads settings via monsterinsights_ads_get_settings AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "information-disclosure", "settings-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5399-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~i"}, {"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[0-9]+(?:\\\\.[0-9]+)?\\\\s+[^\\"\'<>]{0,80}?\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2026-5399", "description": "Redux Framework <=4.5.13.1 authenticated (subscriber+) stored XSS via slider field attribute breakout in profile save handler", "mode": "block", "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13.1"}, "RULE-CVE-2026-5400-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~i"}, {"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|input|submit|keydown|keyup)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-5400", "description": "Redux Framework <=4.5.13 subscriber+ stored XSS via unsanitized nested Media field filter value in profile save (user_meta_save)", "mode": "block", "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-5410-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|keyup|keydown|submit|animationstart|pointerover|focusin)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5410", "description": "Redux Framework <=4.5.13 authenticated (subscriber+) stored XSS via spinner field in own profile save (user_meta_save)", "mode": "block", "severity": 6.4, "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-5410-02": {"action": "edit_user_profile_update", "conditions": [{"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|keyup|keydown|submit|animationstart|pointerover|focusin)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5410", "description": "Redux Framework <=4.5.13 authenticated (subscriber+) stored XSS via spinner field when saving another user\'s profile (user_meta_save)", "mode": "block", "severity": 6.4, "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-54191-01": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-54191", "description": "Pods <=3.3.8 reflected XSS via pod parameter in pq_loadpod AJAX handler", "mode": "block", "severity": 7.1, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2026-54192-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:ays_pb_tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via ays_pb_tab parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via popup_category parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via popupbox parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54196-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:_jf_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-54196", "description": "JetFormBuilder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation via Update User Action", "mode": "block", "severity": 6.8, "slug": "jetformbuilder", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-5425-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/trustindex-feed-instagram/v1/webhook(?:[/?]|$)~"}, {"name": "ARGS:data[feed_data]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5425", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5425", "description": "Social Photo Feed Widget <=1.7.9 unauthenticated stored XSS via REST webhook feed_data injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "social-photo-feed-widget", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.9"}, "RULE-CVE-2026-5427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|templates|template-parts)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"kubio\\"[\\\\s\\\\S]{0,1000}?\\\\bhttps?://~i"}, {"name": "", "type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-5427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5427", "description": "Kubio AI Page Builder <=2.7.2 missing authorization on rest_pre_insert allows contributor-level arbitrary remote file import via kubio block attribute URL", "mode": "block", "severity": 5.3, "slug": "kubio", "tags": ["missing-authorization", "arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5465-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:call", "type": "regex", "value": "~users/providers/~i"}, {"name": "ARGS:externalId", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-5465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5465", "description": "Amelia Booking <=2.1.3 IDOR account takeover via externalId in provider profile update (wpamelia_api)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ameliabooking", "tags": ["idor", "account-takeover", "insecure-direct-object-reference", "authenticated"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-5478-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}(?:.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))?~i"}], "cve": "CVE-2026-5478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5478", "description": "Everest Forms <=3.4.4 unauthenticated arbitrary file read and deletion via path traversal in old_files parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "everest-forms", "tags": ["path-traversal", "local-file-inclusion", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-54802-01": {"ajax_action": "process_campaign", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54802", "description": "Block unauthenticated access to process_campaign AJAX action (CWE-862 Missing Authorization)", "mode": "block", "severity": 7.5, "slug": "sms-alert", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2026-54805-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:falang_user", "type": "exists"}, {"name": "ARGS:user_id", "type": "not_current_user"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-54805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54805", "description": "Falang multilanguage <=1.4.2 subscriber+ privilege escalation via profile update IDOR (personal_options_update)", "mode": "block", "severity": 8.8, "slug": "falang", "tags": ["privilege-escalation", "missing-authorization", "idor"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-54805-02": {"action": "edit_user_profile_update", "conditions": [{"name": "ARGS:falang_user", "type": "exists"}, {"name": "ARGS:user_id", "type": "not_current_user"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-54805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54805", "description": "Falang multilanguage <=1.4.2 subscriber+ privilege escalation via profile update IDOR (edit_user_profile_update)", "mode": "block", "severity": 8.8, "slug": "falang", "tags": ["privilege-escalation", "missing-authorization", "idor"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-54810-01": {"ajax_action": "build_payment_payload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on build_payment_payload AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-02": {"ajax_action": "apple_pay_validate_merchant", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on apple_pay_validate_merchant AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-03": {"ajax_action": "validate_checkout_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on validate_checkout_form AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-04": {"ajax_action": "get_build_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on get_build_fields AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54813-01": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-02": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-03": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-04": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54814-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 unauthenticated local file inclusion via template parameter in mvl_motors_starter_template AJAX handler", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54814-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 missing authorization on mvl_motors_starter_demo_install allows unauthenticated file write/delete", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "arbitrary-file-write", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54818-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:pageview_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\b(?:AND|OR)\\\\s+(?:\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54818", "description": "Slimstat Analytics <=5.4.11 authenticated (Subscriber+) blind SQL injection via pageview_id in slimstat_load_report AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<=5.4.11"}, "RULE-CVE-2026-54819-01": {"ajax_action": "lsd_accordion_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in accordion sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-02": {"ajax_action": "lsd_grid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in grid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-03": {"ajax_action": "lsd_list_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in list sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-04": {"ajax_action": "lsd_gallery_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in gallery sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-05": {"ajax_action": "lsd_halfmap_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in halfmap sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-06": {"ajax_action": "lsd_masonry_load_more", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in masonry load_more AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-07": {"ajax_action": "lsd_mosaic_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in mosaic sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-08": {"ajax_action": "lsd_listgrid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in listgrid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-09": {"ajax_action": "lsd_side_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in side sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-10": {"ajax_action": "lsd_table_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in table sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-11": {"ajax_action": "lsd_timeline_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in timeline sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54821-01": {"ajax_action": "vlp_get_template", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54821", "description": "Visual Link Preview <=2.3.1 subscriber+ sensitive data exposure via vlp_get_template AJAX handler missing capability check", "mode": "block", "severity": 7.4, "slug": "visual-link-preview", "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-54822-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/salesmanago/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54822", "description": "SALESmanago & Leadoo <=3.11.2 subscriber+ SQL injection via REST API endpoint", "mode": "block", "severity": 8.5, "slug": "salesmanago", "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-54823-01": {"ajax_action": "widgetopts_get_settings_ajax", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-54823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54823", "description": "Widget Options <=4.2.3 authenticated (Contributor+) broken access control on arbitrary post_id via widgetopts_get_settings_ajax AJAX handler", "mode": "pass", "severity": 9.9, "slug": "widget-options", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=4.2.3"}, "RULE-CVE-2026-54825-01": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54825", "description": "wpDataTables <=7.4 unauthenticated SQL injection via table_id in wdtable_update_cache AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpdatatables", "target": "plugin", "versions": "<=7.4"}, "RULE-CVE-2026-54828-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_template AJAX handler (LFI via include sink)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54828-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_demo_install AJAX handler (file_put_contents/unlink sinks)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54831-01": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_order in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-02": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:package_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via package_id in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-03": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_by in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-essence/v1/gutenverse-essence-proxy~"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-54832", "description": "Block unauthenticated access to gutenverse-essence REST proxy route (missing authorization \\u2013 permission_callback was __return_true in <=2.5.0)", "mode": "block", "severity": 7.5, "slug": "gutenverse-companion", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2026-54836-01": {"ajax_action": "ymc_get_posts", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in ymc_get_posts AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-02": {"ajax_action": "ymc_get_posts", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in ymc_get_posts AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-03": {"ajax_action": "ymc_autocomplete_search", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in ymc_autocomplete_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-04": {"ajax_action": "ymc_autocomplete_search", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in ymc_autocomplete_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-05": {"ajax_action": "get_post_popup", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in get_post_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-06": {"ajax_action": "get_post_popup", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in get_post_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54840-01": {"ajax_action": "newsletters_forms_createform", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_createform AJAX handler allows subscriber+ form creation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-02": {"ajax_action": "newsletters_forms_addfield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_addfield AJAX handler allows subscriber+ form field addition", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-03": {"ajax_action": "newsletters_forms_deletefield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_deletefield AJAX handler allows subscriber+ form field deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-04": {"ajax_action": "newsletters_admin_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_admin_mode AJAX handler allows subscriber+ admin mode toggle", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-05": {"ajax_action": "newsletters_change_themefolder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_change_themefolder AJAX handler allows subscriber+ theme folder change", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-06": {"ajax_action": "newsletters_delete_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_delete_option AJAX handler allows subscriber+ option deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-07": {"ajax_action": "newsletters_pause_queue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_pause_queue AJAX handler allows subscriber+ queue manipulation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/apbd-vtpos/v1/(?:current-user|get-logged-user|cashier-details|cash-drawer-info|cash-drawer-list|all-outlet-list|all-categories|all-taxes|heart-bit|list|details|end-of-day-data|categories|countries|attributes|getStock|close-cash-drawer|logout|email)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54841", "description": "VitePOS Lite <=3.4.2 unauthenticated sensitive data exposure via REST API endpoints missing permission callbacks", "mode": "block", "severity": 7.5, "slug": "vitepos-lite", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-54842-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/messages(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54842", "description": "Royal MCP <=1.4.25 missing authorization on royal-mcp/v1/messages REST endpoint allows subscriber+ access to privileged integration handlers", "mode": "block", "severity": 8.1, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.25"}, "RULE-CVE-2026-54844-01": {"ajax_action": "checkview_get_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview_get_status AJAX action (CWE-862: Missing Authorization). Patch removes both wp_ajax_nopriv_checkview_get_status and wp_ajax_checkview_get_status hooks entirely.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/checkview/v1/checkview-status(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview/v1/checkview-status REST route (CWE-862: Missing Authorization). Patch adds permission_callback with current_user_can(\'manage_options\') and nonce verification.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:wishlist_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via wishlist_id in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=premmerce_wishlist_popup~"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in WC AJAX wishlist popup handler", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-5488-01": {"ajax_action": "exactmetrics_ads_get_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_get_token allows subscriber+ role access to Google Ads OAuth token", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5488-02": {"ajax_action": "exactmetrics_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_reset_experience allows subscriber+ role to reset Google Ads experience", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5502-01": {"ajax_action": "tutor_update_course_content_order", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5502", "mode": "block", "severity": 5.3, "slug": "tutor", "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-56006-01": {"ajax_action": "h5p_embed", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56006", "description": "H5P <=1.17.6 unauthenticated reflected XSS via id parameter in h5p_embed AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.6"}, "RULE-CVE-2026-56011-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapp/v1/(?:maps|maps/(?:clone|import))(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/][^>]*on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-56011", "description": "MapPress Maps for WordPress <=2.97.3 unauthenticated stored XSS via REST API map creation/update endpoints", "mode": "block", "severity": 7.1, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.97.3"}, "RULE-CVE-2026-56012-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|\\\\bSELECT\\\\s+.*\\\\bFROM\\\\b|/\\\\*[^*]*\\\\*/|information_schema)~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:--|#))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[order] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56014-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_params parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_id parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via orderby parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via order parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:post_mime_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via post_mime_type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:detached", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via detached parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56027-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wcj-my-products~i"}, {"name": "FILES:wcj_add_new_product_image:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-56027", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56027", "description": "Booster for WooCommerce (woocommerce-jetpack) <=8.0.1 authenticated Customer arbitrary file upload via Product by User image field", "mode": "pass", "severity": 9.9, "slug": "woocommerce-jetpack", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=8.0.1"}, "RULE-CVE-2026-56028-01": {"ajax_action": "eel_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-56028", "description": "Easy Elements for Elementor <=1.4.9 unauthenticated privilege escalation via role parameter in eel_register AJAX handler", "mode": "block", "severity": 9.8, "slug": "easy-elements", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2026-56030-01": {"ajax_action": "pt_ajax_check_item_limits", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56030", "description": "Paytium <=5.0.2 unauthenticated privilege escalation via pt_ajax_check_item_limits", "mode": "block", "severity": 9.8, "slug": "paytium", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-56036-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via order_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:refund_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via refund_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:payment_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via payment_action parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:_pafw_uid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via _pafw_uid parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56040-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-form/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/].*?on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-56040", "description": "Gutenverse Form <=2.4.7 unauthenticated stored XSS via form submission REST API", "mode": "block", "severity": 7.1, "slug": "gutenverse-form", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-56042-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_mark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_mark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56042-02": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_unmark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_unmark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56043-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_submit_review AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56043-02": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_local_forms_submit AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56053-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:(?:\\\\\\"|\\\\{)~"}], "cve": "CVE-2026-56053", "description": "EventPrime <=4.3.4.1 subscriber+ PHP Object Injection via eventprime_api AJAX handler", "mode": "block", "severity": 8.8, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.4.1"}, "RULE-CVE-2026-56054-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:jsst_dir", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:\\\\b|[._])|error_log|debug\\\\.log))~i"}], "cve": "CVE-2026-56054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56054", "description": "JS Help Desk <=3.1.1 subscriber+ arbitrary file/directory deletion via jsticket_ajax AJAX handler (path traversal in jsst_dir)", "mode": "block", "severity": 7.7, "slug": "js-support-ticket", "tags": ["path-traversal", "arbitrary-file-deletion", "missing-authorization"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2026-56060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcdn/v1/(?:settings|dashboard|templates|fonts)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-56060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56060", "description": "Print Invoice & Delivery Notes for WooCommerce <=7.1.1 unauthenticated sensitive data exposure via REST API endpoints (wcdn/v1/settings, dashboard, templates, fonts)", "mode": "block", "severity": 7.5, "slug": "woocommerce-delivery-notes", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-56063-01": {"ajax_action": "mcbSubmit_Form_Data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 unauthenticated broken access control on mcbSubmit_Form_Data AJAX handler", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-02": {"ajax_action": "mcb_get_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcb_get_access_token allows subscriber+ OAuth token retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-03": {"ajax_action": "mcbAudienceList", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbAudienceList allows subscriber+ audience list retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-04": {"ajax_action": "mcbSubmit_Form_AudienceId", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbSubmit_Form_AudienceId allows subscriber+ audience ID modification", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56064-01": {"ajax_action": "tf_booking_calendar_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_calendar_filter AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-02": {"ajax_action": "tf_booking_details_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_details_popup AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-03": {"ajax_action": "tf_order_bulk_action_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_bulk_action_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-04": {"ajax_action": "tf_order_status_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_status_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-05": {"ajax_action": "tf_visitor_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_visitor_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-06": {"ajax_action": "tf_checkinout_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_checkinout_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56070-01": {"ajax_action": "thaps_ajax_get_search_value", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-56070", "description": "Unauthenticated SQL Injection via thaps_ajax_get_search_value AJAX handler in TH Advance Product Search <= 1.4.4", "mode": "block", "severity": 9.3, "slug": "th-advance-product-search", "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2026-56071-01": {"ajax_action": "forminator_submit_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via form submission field values", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-56071-02": {"ajax_action": "forminator_submit_preview_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via preview form submission", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-5710-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:[/?]|$)~"}, {"name": "ARGS:mfile", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2026-5710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5710", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.9.6 unauthenticated path traversal leading to arbitrary file read via mfile[] parameter on CF7 REST feedback endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.9.6"}, "RULE-CVE-2026-5714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "enable-media-replace/enable-media-replace.php"}, {"name": "ARGS:location_dir", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5714", "description": "Enable Media Replace <=4.1.8 authenticated (Author+) stored XSS via location_dir parameter", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "target": "plugin", "versions": "<=4.1.8"}, "RULE-CVE-2026-5722-01": {"ajax_action": "wlfmc_waitlist_signup", "conditions": [{"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist token reuse with email change", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-5722-02": {"action": "init", "conditions": [{"name": "ARGS:waitlist_verify", "type": "equals", "value": "1"}, {"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist verification link token reuse (blocks verification endpoint on vulnerable version; legitimate verification clicks also blocked until patched to 1.9.15)", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "verification-link", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-57317-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~simply-schedule-appointments/booking-app-new/iframe-inner\\\\.php~"}, {"name": "ARGS:token", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?![\\\\s])(?!(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-57317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57317", "description": "Simply Schedule Appointments <=1.6.12.2 unauthenticated reflected XSS via token parameter in booking iframe", "mode": "block", "severity": 7.1, "slug": "simply-schedule-appointments", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=1.6.12.2"}, "RULE-CVE-2026-57319-01": {"ajax_action": "woocs_convert_currency", "conditions": [{"name": "ARGS:precision", "type": "exists"}, {"name": "ARGS:precision", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'precision\' parameter in the woocs_convert_currency AJAX handler (wp_die sink at woocs.php:3728). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57319-02": {"ajax_action": "woocs_rates_current_currency", "conditions": [{"name": "ARGS:exclude", "type": "exists"}, {"name": "ARGS:exclude", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'exclude\' parameter in the woocs_rates_current_currency AJAX handler (wp_die sink at woocs.php:3754). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57321-01": {"ajax_action": "h5p_files", "conditions": [{"name": "ARGS:filePath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57321", "description": "H5P <=1.17.7 contributor+ arbitrary file deletion via path traversal in h5p_files AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.7"}, "RULE-CVE-2026-57631-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popup_category parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popupbox parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57636-01": {"ajax_action": "wpforo_ai_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57636", "description": "wpForo Forum <=3.0.9 contributor+ SQL injection via wpforo_ai_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "wpforo", "target": "plugin", "versions": "<=3.0.9"}, "RULE-CVE-2026-57644-01": {"ajax_action": "mprm_process_checkout", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57644-02": {"ajax_action": "mprm_process_checkout_login", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout_login AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57645-01": {"ajax_action": "newsletters_executemultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_executemultiple AJAX handler allows subscriber+ batch operations", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57645-02": {"ajax_action": "newsletters_exportmultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_exportmultiple AJAX handler allows subscriber+ data export", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57663-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via orderby parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57663-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via order parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57713-01": {"action": "admin_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57713", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57713", "description": "Events Manager <=7.3.6 PHP Object Injection via unserialize() in multilingual/install data handling (CWE-502)", "mode": "block", "severity": 8.8, "slug": "events-manager", "tags": ["object-injection", "deserialization", "csrf"], "target": "plugin", "versions": "<=7.3.6"}, "RULE-CVE-2026-57724-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57724", "description": "Kirki <=6.0.12 authenticated PHP object injection via update-form-cell request writing to data field later unserialized without allowed_classes restriction", "mode": "block", "severity": 9.8, "slug": "kirki", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57726-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "kirki_wp_admin_get_apis"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57726", "description": "Blocks unauthorized access to Kirki\'s kirki_wp_admin_get_apis AJAX endpoint, which the plugin\'s own code treats as admin-only (nopriv variant dispatches to kirki_wp_admin_unauthorized) but lacked a current_user_can() capability check prior to 6.0.13.", "mode": "block", "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57726-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "kirki_wp_admin_post_apis"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57726", "description": "Blocks unauthorized access to Kirki\'s kirki_wp_admin_post_apis AJAX endpoint, which the plugin\'s own code treats as admin-only (nopriv variant dispatches to kirki_wp_admin_unauthorized) but lacked a current_user_can() capability check prior to 6.0.13.", "mode": "block", "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57727-01": {"ajax_action": "kirki_get_apis", "conditions": [{"name": "ARGS:/post_id|session_id|term_id/", "type": "exists"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57727", "description": "Kirki <=6.0.13 missing authorization on kirki_get_apis AJAX handler allows unauthenticated IDOR access via post_id/session_id/term_id", "mode": "block", "severity": 7.5, "slug": "kirki", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.0.13"}, "RULE-CVE-2026-57728-01": {"action": "wp_footer", "conditions": [{"name": "ARGS:block", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-57728", "description": "Flatsome theme <=3.20.5 unauthenticated reflected XSS via block parameter in ux_block_frontend()", "mode": "block", "severity": 7.1, "slug": "flatsome", "target": "theme", "versions": "<=3.20.5"}, "RULE-CVE-2026-57737-01": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:ID", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via ID parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-02": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via type parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-03": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:tmpl", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via tmpl parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-04": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via title parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-05": {"ajax_action": "aux_ajax_lightbox", "conditions": [{"name": "ARGS:preview", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via preview parameter in aux_ajax_lightbox AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-06": {"ajax_action": "aux_the_recent_products", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 unauthenticated reflected XSS via data parameter in aux_the_recent_products AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57773-01": {"ajax_action": "wc_ast_upload_csv_form_update", "conditions": [{"name": "ARGS:tracking_provider", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND)\\\\s|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|#|/\\\\*)~i"}], "cve": "CVE-2026-57773", "description": "Advanced Shipment Tracking for WooCommerce <=4.0 authenticated (Shop Manager+) blind SQL injection via tracking_provider parameter in CSV import AJAX handler", "mode": "block", "slug": "woo-advanced-shipment-tracking", "target": "plugin", "versions": "<=4.0"}, "RULE-CVE-2026-57813-01": {"ajax_action": "mailoptin_connect_process", "conditions": [{"name": "", "type": "missing_capability", "value": "administrator"}], "cve": "CVE-2026-57813", "description": "MailOptin <=1.2.77.3 unauthenticated privilege escalation via mailoptin_connect_process AJAX handler (removed wp_ajax_nopriv exposure, missing capability check)", "mode": "block", "severity": 9.8, "slug": "mailoptin", "target": "plugin", "versions": "<=1.2.77.3"}, "RULE-CVE-2026-57813-02": {"action": "admin_post_mailoptin_upgrader", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57813", "description": "MailOptin <=1.2.77.3 missing authorization on admin_post_mailoptin_upgrader allows unauthorized upgrade/install action", "mode": "block", "severity": 9.8, "slug": "mailoptin", "target": "plugin", "versions": "<=1.2.77.3"}, "RULE-CVE-2026-5809-01": {"ajax_action": "wpforo_ai_wp_get_post_types", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_get_post_types AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-02": {"ajax_action": "wpforo_ai_wp_get_taxonomies", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomies AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-03": {"ajax_action": "wpforo_ai_wp_get_taxonomy_terms", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomy_terms AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-04": {"ajax_action": "wpforo_ai_wp_index_by_taxonomy", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_index_by_taxonomy AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-05": {"ajax_action": "wpforo_ai_wp_index_custom", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_index_custom AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5821-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metakeyinput", "type": "equals", "value": "image_optimizer_metadata"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~s:7:\\"backups\\";a:[0-9]+:{~i"}], "cve": "CVE-2026-5821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5821", "description": "Image Optimizer <=1.7.4 arbitrary file deletion via untrusted absolute paths injected into image_optimizer_metadata post meta backups array", "mode": "pass", "severity": 8.1, "slug": "image-optimization", "tags": ["arbitrary-file-deletion", "insufficient-path-validation", "authenticated"], "target": "plugin", "versions": "<=1.7.4"}, "RULE-CVE-2026-59525-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS:search_field", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9a-zA-Z\'\\"]+\\\\s*=\\\\s*[0-9a-zA-Z\'\\"]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*.*?\\\\*/|--\\\\s|#\\\\s)~i"}], "cve": "CVE-2026-59525", "description": "Participants Database <=2.7.8.3 unauthenticated SQL injection via search_field in pdb_list_filter AJAX handler", "mode": "block", "severity": 9.3, "slug": "participants-database", "target": "plugin", "versions": "<=2.7.8.3"}, "RULE-CVE-2026-59530-01": {"ajax_action": "wc_stripe_admin_request", "conditions": [{"name": "ARGS:path", "type": "exists"}, {"name": "ARGS:path", "type": "regex", "value": "~^/?(?:wp/v2/(?:users|settings|plugins|themes|application-passwords|options)|wc/v3(?:/|$)|wc-admin|wc-analytics|jwt-auth)~i"}], "cve": "CVE-2026-59530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-59530", "description": "Stripe For WooCommerce (woo-stripe-payment) <=4.0.7 broken access control via wc_stripe_admin_request AJAX-to-REST dispatch bridge allowing pivot to sensitive REST namespaces", "mode": "block", "severity": 7.5, "slug": "woo-stripe-payment", "tags": ["missing-authorization", "broken-access-control", "rest-api-pivot"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-59549-01": {"ajax_action": "rtmedia_rt_album_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-59549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-59549", "description": "rtMedia for WordPress, BuddyPress and bbPress <=4.7.10 missing authorization on BuddyPress album import AJAX handler (rtmedia_rt_album_import), hardened in the same 4.7.11 release that addresses CVE-2026-59549", "mode": "block", "severity": 9.3, "slug": "buddypress-media", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=4.7.10"}, "RULE-CVE-2026-59558-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpbc-settings"}, {"name": "ARGS:form_visible_section", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-59558", "description": "Booking Calendar <=11.4.3 reflected XSS via form_visible_section parameter on wpbc-settings admin page", "mode": "block", "severity": 7.1, "slug": "booking", "target": "plugin", "versions": "<=11.4.3"}, "RULE-CVE-2026-5957-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/emailkit/v1/create[_-]template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 authenticated arbitrary file read via REST create_template emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-03": {"ajax_action": "emailkit_admin_action", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_admin_action AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-04": {"ajax_action": "emailkit_filter_save_as_template", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_filter_save_as_template AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-60137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-03": {"action": "init", "conditions": [{"name": "ARGS:/^author_exclude$|^author__not_in$/", "type": "detectSQLi"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress Core SQL injection via author__not_in / REST author_exclude in WP_Query (wp2shell SQLi primitive) - standalone/plugin-mediated parameter and WP 6.8.x coverage not addressed by the batch-scoped rules -01/-02.", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "unauthenticated", "wp-core", "wp2shell", "defense-in-depth"], "target": "core", "versions": ">=6.8.0 <6.8.6 || >=6.9.0 <6.9.5 || >=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6101-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "amp_settings"}, {"name": "ARGS:ampforwp-local-font-zip", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]|%2[Ee]{1,2}%2[Ee]{0,1}[/\\\\\\\\%]|%252[Ee]%252[Ee]%25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-6101", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6101", "description": "AMP for WP <=1.1.12 authenticated Author+ arbitrary file write via ZIP-slip path traversal in ampforwp_save_local_font local font upload", "mode": "block", "severity": 7.5, "slug": "accelerated-mobile-pages", "tags": ["arbitrary-file-write", "path-traversal", "zip-slip", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-61949-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:import", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|/\\\\*.*?\\\\*/|--\\\\s|#\\\\s|`[^`]*`\\\\s*(?:=|,)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-61949", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61949", "description": "Bookly <=27.7 unauthenticated SQL injection via import parameter reaching $wpdb->query in diagnostics AJAX handler", "mode": "block", "severity": 9.3, "slug": "bookly-responsive-appointment-booking-tool", "tags": ["sql-injection", "unauthenticated", "diagnostics"], "target": "plugin", "versions": "<=27.7"}, "RULE-CVE-2026-61961-01": {"ajax_action": "fetch_video_description", "conditions": [{"name": "ARGS:vid", "type": "regex", "value": "~(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<svg[^>]*>|<img[^>]*>|\\"\\\\s*>|\'\\\\s*>)~i"}], "cve": "CVE-2026-61961", "description": "EmbedPress <=4.5.6 unauthenticated reflected XSS via vid parameter in fetch_video_description AJAX handler", "mode": "block", "slug": "embedpress", "target": "plugin", "versions": "<=4.5.6"}, "RULE-CVE-2026-61964-01": {"ajax_action": "ninja_tables_dt_public", "conditions": [{"name": "ARGS:/table_id|draw|start|length/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|[\\"\'<>])~i"}], "cve": "CVE-2026-61964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61964", "description": "Ninja Tables <=5.2.9 unauthenticated reflected XSS via table_id/draw/start/length parameters on ninja_tables_dt_public AJAX handler", "mode": "block", "severity": 7.1, "slug": "ninja-tables", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=5.2.9"}, "RULE-CVE-2026-61967-01": {"ajax_action": "mo_osp_check_blocked", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-61967", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61967", "description": "miniOrange OTP Verification <=5.5.1 unauthenticated privilege escalation via missing authorization on OTP Spam Preventer mo_osp_check_blocked AJAX handler", "mode": "block", "severity": 9.8, "slug": "miniorange-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2026-61967-02": {"ajax_action": "mo_osp_unblock_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-61967", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61967", "description": "miniOrange OTP Verification <=5.5.1 unauthenticated privilege escalation via missing authorization on OTP Spam Preventer mo_osp_unblock_user AJAX handler", "mode": "block", "severity": 9.8, "slug": "miniorange-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2026-61979-01": {"action": "init", "conditions": [{"name": "ARGS:SAMLResponse", "type": "regex", "value": "~(?:a[^A-Za-z0-9+/=]*G[^A-Za-z0-9+/=]*1[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*y[^A-Za-z0-9+/=]*1[^A-Za-z0-9+/=]*z[^A-Za-z0-9+/=]*a[^A-Za-z0-9+/=]*G[^A-Za-z0-9+/=]*E[^A-Za-z0-9+/=]*x|h[^A-Za-z0-9+/=]*t[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*W[^A-Za-z0-9+/=]*M[^A-Za-z0-9+/=]*t[^A-Za-z0-9+/=]*c[^A-Za-z0-9+/=]*2[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*M|o[^A-Za-z0-9+/=]*b[^A-Za-z0-9+/=]*W[^A-Za-z0-9+/=]*F[^A-Za-z0-9+/=]*j[^A-Za-z0-9+/=]*L[^A-Za-z0-9+/=]*X[^A-Za-z0-9+/=]*N[^A-Za-z0-9+/=]*o[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*T)~"}], "cve": "CVE-2026-61979", "cve_link": "https://www.cve.org/CVERecord?id=CVE-2026-61979", "description": "miniOrange SAML SSO accepts an HMAC-SHA1 SignatureMethod and verifies it with the IdP public certificate as the shared secret, letting anyone forge a signed SAMLResponse", "method": "POST", "mode": "block", "severity": 8.1, "slug": "miniorange-saml-20-single-sign-on", "tags": ["authentication-bypass", "privilege-escalation", "saml", "signature-forgery", "unauthenticated", "actively-exploited"], "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2026-61982-01": {"action": "init", "conditions": [{"name": "ARGS:redirect_to", "type": "regex", "value": "~(?:[\\"\'<>]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-61982", "description": "SiteGuard <=1.8.6 unauthenticated reflected XSS via redirect_to parameter reaching filter_logout_url href output", "mode": "block", "slug": "siteguard", "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2026-6203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "logout"}, {"name": "ARGS:redirect_to_on_logout", "type": "regex", "value": "~^\\\\s*(?:(?:https?:)?//|[a-zA-Z][a-zA-Z0-9+.-]*:)~i"}], "cve": "CVE-2026-6203", "description": "User Registration <=5.1.4 unauthenticated open redirect via redirect_to_on_logout parameter on wp-login.php logout", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-62062-01": {"action": "admin_post_elementor_site_clear_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-62062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62062", "description": "Elementor Website Builder <=4.3.1 CSRF via admin_post_elementor_site_clear_cache missing capability check on cache-clearing action", "mode": "block", "severity": 8.8, "slug": "elementor", "tags": ["csrf", "missing-authorization", "state-change", "authenticated"], "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-62103-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^everest_forms_~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:[OC]:[0-9]+:\\"[^\\"]*\\":[0-9]+:\\\\{|a:[0-9]+:\\\\{)~"}], "cve": "CVE-2026-62103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62103", "description": "Everest Forms <=3.6.0 unauthenticated PHP object injection via serialized upload field value processed by html_field_value()", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.6.0"}, "RULE-CVE-2026-62107-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-62107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62107", "description": "Masteriyo LMS <=3.4.0 unauthenticated PHP object injection via serialized payload reaching unhardened maybe_unserialize reads in certificate, course-announcement, google-meet, group-courses, and wishlist repository metadata hydration (write-side entrypoint not resolved in current evidence; generic serialized-object-header detection applied as defense-in-depth)", "mode": "block", "severity": 8.8, "slug": "learning-management-system", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2026-6227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/getblock(?:[/?&]|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:(?:(?:\\\\.\\\\.|%2e%2e)[\\\\\\\\/]|(?:\\\\.\\\\.|%2e%2e)(?:%2f|%5c)){2,}|(?:\\\\.{4,}[\\\\\\\\/]{1,}){2,}|%252e%252e(?:%252f|%255c|%2f|%5c|/|\\\\\\\\))~i"}], "cve": "CVE-2026-6227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6227", "description": "BackWPup <=5.6.6 authenticated local file inclusion via block_name parameter in /backwpup/v1/getblock REST endpoint", "mode": "block", "severity": 7.2, "slug": "backwpup", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.6"}, "RULE-CVE-2026-6229-01": {"action": "init", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via Data Table widget CSV URL parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6229-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via url parameter in Data Table CSV fetch", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6235-01": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apikey", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via manage_admin_requests", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6235-02": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apisecret", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via sm_apisecret", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (admin-post.php)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6248-02": {"action": "init", "conditions": [{"name": "ARGS:wpforo", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (front-end profile update)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6275-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:</script|<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|input|blur)\\\\s*=|javascript\\\\s*:|\\"\\\\s*;)~i"}], "cve": "CVE-2026-6275", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6275", "description": "StatCounter <=2.1.1 Author+ stored XSS via nickname field echoed unescaped into JavaScript context by statcounter_addToTags()", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-63030-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-63030-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6320-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-6320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6320", "description": "Salon Booking System <=10.30.25 unauthenticated arbitrary file read via booking attachment file field path traversal", "mode": "block", "severity": 7.5, "slug": "salon-booking-system", "tags": ["arbitrary-file-read", "path-traversal", "unauthenticated", "file-inclusion"], "target": "plugin", "versions": "<=10.30.25"}, "RULE-CVE-2026-6372-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^WC_Gateway_Plisio$~i"}, {"name": "ARGS:status", "type": "regex", "value": "~^(?:completed|mismatch|expired|cancelled)$~i"}], "cve": "CVE-2026-6372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6372", "description": "Accept Cryptocurrencies with Plisio <=2.0.5 unauthenticated payment bypass via forged wc-api callback", "mode": "block", "severity": 7.5, "slug": "plisio-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "payment-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-6403-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/v1/blueprint/[^/?]+(?:[/?]|$)~"}, {"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[a-z]:[/\\\\\\\\]|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-6403", "description": "Quick Playground <=1.3.3 unauthenticated path traversal via stylesheet parameter in blueprint REST endpoint", "mode": "block", "severity": 7.5, "slug": "quick-playground", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2026-6427-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<video[^>]*(?:on(?:focus|error|load|mouseover|click|mouseenter)\\\\s*=|autofocus[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6427", "description": "a3 Lazy Load <=2.7.6 contributor+ stored XSS via crafted video element in post content (post editor)", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-6427-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<video[^>]*(?:on(?:focus|error|load|mouseover|click|mouseenter)\\\\s*=|autofocus[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6427", "description": "a3 Lazy Load <=2.7.6 contributor+ stored XSS via crafted video element in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-6431-01": {"action": "init", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<svg[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-6431", "description": "Profile Builder <=3.15.7 unauthenticated stored XSS via Biographical Info \'description\' field on front-end registration/edit-profile forms", "mode": "block", "slug": "profile-builder", "target": "plugin", "versions": "<=3.15.7"}, "RULE-CVE-2026-6456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/account-switcher/v1/remember-login(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6456", "description": "Account Switcher <=1.0.2 privilege escalation via rememberLogin REST endpoint loose comparison", "mode": "block", "severity": 8.8, "slug": "account-switcher", "tags": ["authentication-bypass", "privilege-escalation", "rest-api", "unauthenticated-from-subscriber"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-64638-01": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through the wp-login.php username or email field", "method": "POST", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-02": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:X-HTTP-Method-Override", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with an HTTP method-override header", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-03": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^_method$/", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with a form method override", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-6495-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_container_type", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_container_type", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_color", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_color", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_custom_js", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_custom_js", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_default_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_default_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-theme-templates~"}, {"name": "ARGS:alm_theme_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_theme_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-licenses~"}, {"name": "ARGS:alm_license_key", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_license_key", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_preview", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_preview", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-65048-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-65048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65048", "description": "Ninja Forms >=3.10.4 <3.14.9 unauthenticated stored XSS via crafted repeater submission index in nf_ajax_submit formData", "mode": "block", "severity": 9.3, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "unauthenticated", "form-submission"], "target": "plugin", "versions": ">=3.10.4 <3.14.9"}, "RULE-CVE-2026-65048-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-65048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65048", "description": "Ninja Forms >=3.10.4 <3.14.9 unauthenticated stored XSS via crafted repeater submission index in nf_ajax_resume formData", "mode": "block", "severity": 9.3, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "unauthenticated", "form-submission"], "target": "plugin", "versions": ">=3.10.4 <3.14.9"}, "RULE-CVE-2026-65050-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_ID", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~ninja-forms/submissions-table~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-65050", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65050", "description": "Ninja Forms <=3.14.8 missing authorization allows Author-level users to embed the ninja-forms/submissions-table block with an arbitrary formID via post save, exposing signed bearer tokens to unauthenticated visitors", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2026-65051-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\"type\\"\\\\s*:\\\\s*\\"[a-z_]+\\".{0,200}\\"(?:required|settings)\\"\\\\s*:~is"}], "cve": "CVE-2026-65051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65051", "description": "Ninja Forms <3.14.9 unauthenticated server-side validation bypass via client-controlled field metadata (type/required/settings) merge in nf_ajax_submit AJAX handler", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["client-side-enforcement", "validation-bypass", "unauthenticated"], "target": "plugin", "versions": "<3.14.9"}, "RULE-CVE-2026-65051-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\"type\\"\\\\s*:\\\\s*\\"[a-z_]+\\".{0,200}\\"(?:required|settings)\\"\\\\s*:~is"}], "cve": "CVE-2026-65051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65051", "description": "Ninja Forms <3.14.9 unauthenticated server-side validation bypass via client-controlled field metadata (type/required/settings) merge in nf_ajax_resume AJAX handler", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["client-side-enforcement", "validation-bypass", "unauthenticated"], "target": "plugin", "versions": "<3.14.9"}, "RULE-CVE-2026-6518-01": {"ajax_action": "cmp_theme_update_install", "conditions": [{"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6518", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6518", "description": "CMP Coming Soon & Maintenance <=4.1.16 authenticated arbitrary file upload via cmp_theme_update_install AJAX action", "mode": "block", "severity": 8.8, "slug": "cmp-coming-soon-maintenance", "tags": ["arbitrary-file-upload", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2026-65437-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~i"}, {"name": "ARGS:m", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img[^>]*onerror)~i"}], "cve": "CVE-2026-65437", "description": "Spam protection, AntiSpam, FireWall by CleanTalk <=6.82 unauthenticated reflected XSS via \'m\' parameter in CleantalkListTable::months_dropdown printf sink", "mode": "block", "slug": "cleantalk-spam-protect", "target": "plugin", "versions": "<=6.82"}, "RULE-CVE-2026-65439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Aa]%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2026-65439", "description": "Ultimate Addons for Contact Form 7 <=3.5.45 reflected XSS via unescaped REQUEST_URI echoed by dynamic-text current-url shortcode", "mode": "block", "severity": 7.1, "slug": "ultimate-addons-for-contact-form-7", "target": "plugin", "versions": "<=3.5.45"}, "RULE-CVE-2026-65509-01": {"ajax_action": "wpdatatables_get_columns_data_by_table_id", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~^(?!^[0-9]+$).+$~"}], "cve": "CVE-2026-65509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65509", "description": "wpDataTables <7.5.2 reflected XSS via unescaped table_id echoed by wpdatatables_get_columns_data_by_table_id AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpdatatables", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<7.5.2"}, "RULE-CVE-2026-65640-01": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-02": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-03": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-04": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-05": {"action": "init", "conditions": [{"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:dps|epi|eps[23fi]?|ept[23]?|ps[23]?|wpg)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PostScript-family upload extension on the WordPress async-upload multipart field, which selects the Imagick PostScript coder and reaches Ghostscript without needing a visible signature", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "postscript-extension"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-06": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:dps|epi|eps[23fi]?|ept[23]?|ps[23]?|wpg)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PostScript-family upload extension on a multipart file field on requests reaching rest_api_init, which selects the Imagick PostScript coder and reaches Ghostscript without needing a visible signature", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "postscript-extension"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-07": {"action": "init", "conditions": [{"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?!%PDF-)~"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~%pipe%|/OutputFile|putdeviceprops|\\\\.forceput|\\\\.libfile|\\\\.tempfile|\\\\.rsdparams|\\\\.setglobal|\\\\.actonuserparams|\\\\.bindnow|deletefile|renamefile~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PDF-family upload on the WordPress async-upload multipart field that lacks the %PDF- signature yet carries a PostScript signature later in the inspected prefix, the pdf_load_source Ghostscript path", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "pdf-signature-mismatch"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-08": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?!%PDF-)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}, {"name": "FILES:file:content", "type": "regex", "value": "~%pipe%|/OutputFile|putdeviceprops|\\\\.forceput|\\\\.libfile|\\\\.tempfile|\\\\.rsdparams|\\\\.setglobal|\\\\.actonuserparams|\\\\.bindnow|deletefile|renamefile~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PDF-family upload on a multipart file field on requests reaching rest_api_init that lacks the %PDF- signature yet carries a PostScript signature later in the inspected prefix, the pdf_load_source Ghostscript path", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "pdf-signature-mismatch"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-09": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?:\\\\x1F\\\\x8B\\\\x08|BZh|\\\\x1F\\\\x9D)~s"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:jpe?g|jpe|png|gif|bmp|tiff?|webp|avif|ico|heic|heif|heics|heifs|ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core compressed payload wearing an image or PDF extension on the WordPress async-upload multipart field, which Imagick transparently decompresses before deciding the format", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "compressed-wrapper"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-10": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?:\\\\x1F\\\\x8B\\\\x08|BZh|\\\\x1F\\\\x9D)~s"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:jpe?g|jpe|png|gif|bmp|tiff?|webp|avif|ico|heic|heif|heics|heifs|ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core compressed payload wearing an image or PDF extension on a multipart file field on requests reaching rest_api_init, which Imagick transparently decompresses before deciding the format", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "compressed-wrapper"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-66424-01": {"ajax_action": "activate_pending_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on activate_pending_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-02": {"ajax_action": "reject_pending_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on reject_pending_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-03": {"ajax_action": "wcmp_suspend_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on wcmp_suspend_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-04": {"ajax_action": "wcmp_activate_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on wcmp_activate_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66439-01": {"ajax_action": "berocket_aapf_color_listener", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66439", "description": "WooCommerce Ajax Product Filters (BeRocket) <=3.2.0.3 reflected XSS via br_product_filter/type parameters in berocket_aapf_color_listener AJAX handler", "mode": "block", "slug": "woocommerce-ajax-filters", "target": "plugin", "versions": "<=3.2.0.3"}, "RULE-CVE-2026-66439-02": {"ajax_action": "br_include_exclude_list", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66439", "description": "WooCommerce Ajax Product Filters (BeRocket) <=3.2.0.3 reflected XSS via br_product_filter parameter in br_include_exclude_list AJAX handler", "mode": "block", "slug": "woocommerce-ajax-filters", "target": "plugin", "versions": "<=3.2.0.3"}, "RULE-CVE-2026-66446-01": {"ajax_action": "ifso_analytics_req", "conditions": [{"name": "ARGS:an_action", "type": "regex", "value": "~^(?:getTriggerReport|resetFields|resetAllAnalytics)$~i"}, {"type": "missing_capability", "value": "administrator"}, {"type": "missing_capability", "value": "editor"}], "cve": "CVE-2026-66446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66446", "description": "If-So Dynamic Content Personalization <1.10.0.1 authorization bypass in ifso_analytics_req AJAX handler (handle()) allows subscriber-level access to administrative report/reset actions (getTriggerReport, resetFields, resetAllAnalytics) that feed SQL injection in records-service queries", "mode": "block", "severity": 9.3, "slug": "if-so", "tags": ["sql-injection", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.10.0.1"}, "RULE-CVE-2026-66457-01": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:header_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66457", "description": "Events Manager <=7.4.1 unauthenticated reflected XSS via header_format parameter in grouped event list AJAX search", "mode": "block", "slug": "events-manager", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2026-66457-02": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:date_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66457", "description": "Events Manager <=7.4.1 unauthenticated reflected XSS via date_format parameter in grouped event list AJAX search", "mode": "block", "slug": "events-manager", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2026-66574-01": {"action": "init", "conditions": [{"name": "ARGS:/title_tag|title_tags|sub_title_size|title_size/", "type": "regex", "value": "~[\\"\'<>\\\\s]|on\\\\w+\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-66574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66574", "description": "Element Pack Elementor Addons <=8.8.3 Contributor stored XSS via unsanitized dynamic HTML tag settings (title_tag, title_tags, sub_title_size, title_size) in animated-card, custom-gallery, and fancy-list widgets", "mode": "block", "severity": 6.5, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "contributor", "elementor-widget"], "target": "plugin", "versions": "<=8.8.3"}, "RULE-CVE-2026-66583-01": {"action": "init", "conditions": [{"name": "ARGS:form_uid", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]*\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-66583", "description": "Forminator <=1.57.0.5 unauthenticated PHP Object Injection via form_uid parameter", "mode": "block", "severity": 9.8, "slug": "forminator", "target": "plugin", "versions": "<=1.57.0.5"}, "RULE-CVE-2026-66602-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^csf_.*_ajax_save$~"}, {"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66602", "description": "HashBar - WordPress Notification Bar <=2.0.0 CSRF via unprotected Codestar admin options ajax_save handler", "mode": "block", "severity": 8.8, "slug": "hashbar-wp-notification-bar", "tags": ["csrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-66608-01": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-66608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66608", "description": "Unlimited Elements For Elementor <=2.0.19 Contributor-level SSRF exposure via unauthorized elementor_integrate template import AJAX action", "mode": "block", "severity": 6.4, "slug": "unlimited-elements-for-elementor", "tags": ["ssrf", "authenticated", "missing-authorization", "elementor"], "target": "plugin", "versions": "<=2.0.19"}, "RULE-CVE-2026-66608-02": {"ajax_action": "unitecreator_elementor_export_template", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-66608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66608", "description": "Unlimited Elements For Elementor <=2.0.19 Contributor-level SSRF exposure via unauthorized elementor_integrate template export AJAX action", "mode": "block", "severity": 6.4, "slug": "unlimited-elements-for-elementor", "tags": ["ssrf", "authenticated", "missing-authorization", "elementor"], "target": "plugin", "versions": "<=2.0.19"}, "RULE-CVE-2026-66618-01": {"action": "init", "conditions": [{"name": "ARGS:map_locations[/[0-9]+/]", "type": "regex", "value": "~^(?![0-9]+$).+$~"}], "cve": "CVE-2026-66618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66618", "description": "WP Maps (wp-google-map-plugin) <5.0.0 administrator SQL injection via non-numeric map_locations array values reaching the shared IN() query builder", "mode": "block", "severity": 7.6, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "administrator", "authenticated"], "target": "plugin", "versions": "<5.0.0"}, "RULE-CVE-2026-66618-02": {"action": "init", "conditions": [{"name": "ARGS:map_locations", "type": "regex", "value": "~^(?![0-9]+$).+$~"}], "cve": "CVE-2026-66618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66618", "description": "WP Maps (wp-google-map-plugin) <5.0.0 administrator SQL injection via non-numeric map_locations scalar value reaching the shared IN() query builder", "mode": "block", "severity": 7.6, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "administrator", "authenticated"], "target": "plugin", "versions": "<5.0.0"}, "RULE-CVE-2026-66659-01": {"ajax_action": "get_redirection_data", "conditions": [{"name": "ARGS:redirect_token", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|[\'\\"]\\\\s*(?:OR|AND)\\\\s|--\\\\s|/\\\\*.*?\\\\*/)~i"}], "cve": "CVE-2026-66659", "description": "Tablesome Table <=1.2.9 unauthenticated blind SQL injection via redirect_token parameter in get_redirection_data AJAX action", "mode": "block", "slug": "tablesome", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2026-66667-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66667", "description": "Templately <=3.7.1 missing authorization on templately_pack_* full-site/template pack import AJAX handler enabling unauthenticated stored XSS via unsanitized custom CSS option", "mode": "block", "severity": 7.1, "slug": "templately", "tags": ["missing-authorization", "stored-xss", "template-import"], "target": "plugin", "versions": "<=3.7.1"}, "RULE-CVE-2026-66708-01": {"ajax_action": "boldgrid_transfer_resync_database", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-66708", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66708", "description": "Total Upkeep (boldgrid-backup) <1.17.3 missing authorization on boldgrid_transfer_resync_database AJAX handler allows any authenticated user to trigger database resync file read/write/delete", "mode": "block", "severity": 8.2, "slug": "boldgrid-backup", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.17.3"}, "RULE-CVE-2026-6690-01": {"ajax_action": "lp_update_mds", "conditions": [{"name": "ARGS:n", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-6690", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6690", "description": "LifePress <=2.2.2 unauthenticated stored XSS via lp_update_mds AJAX action", "mode": "block", "severity": 7.2, "slug": "lifepress", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2026-6741-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:wp_user_id", "type": "exists"}, {"name": "ARGS:customer_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6741", "description": "LatePoint <=5.4.1 privilege escalation via unauthorized customer-to-WordPress-user account linking in latepoint_route_call AJAX action", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "missing-authorization", "account-takeover"], "target": "plugin", "versions": "<=5.4.1"}, "RULE-CVE-2026-6817-01": {"ajax_action": "ays_rate_the_quiz", "conditions": [{"name": "ARGS:rate_reason", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|pointermove|pointerenter|pointerleave|pointercancel|gotpointercapture|lostpointercapture|wheel|contextmenu|copy|cut|paste|drag|dragstart|dragend|dragenter|dragleave|dragover|drop|input|change|select|submit|reset|keydown|keyup|keypress|touchstart|touchend|touchmove|touchcancel|abort|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|resize|storage|unload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=|&#x?0*(?:3c|60)\\\\s*;\\\\s*script)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS via rate_reason parameter in ays_rate_the_quiz AJAX action", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6817-02": {"ajax_action": "ays_load_more_reviews", "conditions": [{"name": "ARGS:start_from", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS render path via ays_load_more_reviews start_from parameter", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6828-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (post.php)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6828-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6916-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~sg_content_number_prefix[\\"\'\\\\\\\\]*\\\\s*:\\\\s*[\\"\'\\\\\\\\]*[^\\"\'}]*(?:[^\\"\'}]|\')*(?:<[a-zA-Z!/]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&#x?[0-9a-f]+;?<|%3C(?:script|img|svg|iframe))~i"}], "cve": "CVE-2026-6916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6916", "description": "Jeg Elementor Kit >=3.0.0 <=3.1.0 contributor+ stored XSS via Fun Fact widget sg_content_number_prefix setting", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": ">=3.0.0 <=3.1.0"}, "RULE-CVE-2026-6933-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "create_plugin"}, {"name": "ARGS:premmerce_plugin_namespace", "type": "regex", "value": "~[;{}()$`]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|phpinfo|file_put_contents|file_get_contents|base64_decode|unlink)\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 authenticated RCE via unsanitized namespace injection in plugin generator", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "generate_data"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on generate_data admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clean_up"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on clean_up admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6963-01": {"ajax_action": "wmg_save_provider_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_save_provider_config allows subscriber+ privilege escalation", "mode": "block", "severity": 9.8, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-02": {"ajax_action": "wmg_get_saved_configs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_get_saved_configs allows subscriber+ data disclosure", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-03": {"ajax_action": "wmg_test_provider_config_send_mail", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_test_provider_config_send_mail allows subscriber+ email sending", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "email-abuse"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-7048-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post content", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7048-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post_content parameter", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7106-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:hscrm_user_roles", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-7106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7106", "description": "Highland Software Custom Role Manager <=1.0.0 authenticated privilege escalation via hscrm_user_roles[] on personal_options_update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "highland-software-custom-role-manager", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7252-01": {"ajax_action": "updraft_smush_ajax", "conditions": [{"name": "ARGS:do", "type": "equals", "value": "unscheduled_original_file_deletion"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-7252", "mode": "block", "severity": 8.1, "slug": "wp-optimize", "target": "plugin", "versions": "<=4.5.2"}, "RULE-CVE-2026-73187-01": {"ajax_action": "scw_save_form_data", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~scw_form_fields\\\\[[^\\\\]]*(?:[`\'\\";)(]|--|#|/\\\\*|UNION\\\\s+SELECT)~i"}], "cve": "CVE-2026-73187", "description": "Sticky Chat Widget <=1.4.2 unauthenticated SQL injection via attacker-controlled scw_form_fields array keys in scw_save_form_data AJAX handler", "mode": "block", "severity": 9.3, "slug": "sticky-chat-widget", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-7330-01": {"ajax_action": "aal_stats_save", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseout|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-7330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7330", "description": "WP Auto Affiliate Links <=6.8.8 unauthenticated stored XSS via url parameter", "mode": "block", "severity": 7.2, "slug": "wp-auto-affiliate-links", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=6.8.8"}, "RULE-CVE-2026-73341-01": {"ajax_action": "rm_activate_user", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-73341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73341", "description": "RegistrationMagic (Custom Registration Form Builder with Submission Manager) <=6.0.9.7 unauthenticated PHP object injection via rm_activate_user AJAX action", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=6.0.9.7"}, "RULE-CVE-2026-73341-02": {"ajax_action": "rm_login_social_user", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-73341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73341", "description": "RegistrationMagic (Custom Registration Form Builder with Submission Manager) <=6.0.9.7 unauthenticated PHP object injection via rm_login_social_user AJAX action", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=6.0.9.7"}, "RULE-CVE-2026-73343-01": {"ajax_action": "wpc_v2_lazy_patch_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated settings write via wpc_v2_lazy_patch_setting AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-02": {"ajax_action": "wpc_v2_lazy_opcache_invalidate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated forced opcode cache invalidation via wpc_v2_lazy_opcache_invalidate AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-03": {"ajax_action": "wpc_v2_lazy_test_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated local file inclusion via image_id parameter in wpc_v2_lazy_test_purge_html AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "local-file-inclusion"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-04": {"ajax_action": "wpc_v2_provision_now", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated CDN/config provisioning via wpc_v2_provision_now AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73348-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-form-preview"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73348", "description": "GiveWP <4.16.6 missing capability check on onboarding form preview allows unauthorized access via page=give-form-preview", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<4.16.6"}, "RULE-CVE-2026-73355-01": {"ajax_action": "wpam_ajax_activate_affiliate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_activate_affiliate AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-02": {"ajax_action": "wpam_ajax_deactivate_affiliate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_deactivate_affiliate AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-03": {"ajax_action": "wpam_ajax_add_transaction", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_add_transaction AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-04": {"ajax_action": "wpam_ajax_delete_creative", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_delete_creative AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-05": {"ajax_action": "wpam_ajax_set_creative_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_set_creative_status AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73356-01": {"action": "init", "conditions": [{"name": "REQUEST_COOKIES:/wcml_client_currency|aelia_cs_selected_currency/", "type": "regex", "value": "~^(?![A-Za-z]{3}$).+~"}], "cve": "CVE-2026-73356", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73356", "description": "Breeze <=2.5.12 unauthenticated cache-variation cookie value manipulation via wcml_client_currency/aelia_cs_selected_currency", "mode": "block", "severity": 8.2, "slug": "breeze", "tags": ["cache-poisoning", "header-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.5.12"}, "RULE-CVE-2026-73381-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~::~"}], "cve": "CVE-2026-73381", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73381", "description": "Popup by Supsystic <=1.13.0 unauthenticated broken authentication via PHP Class::method callable-syntax injection in dynamic admin-ajax action parameter", "mode": "block", "severity": 9.1, "slug": "popup-by-supsystic", "tags": ["missing-authorization", "broken-authentication", "unauthenticated"], "target": "plugin", "versions": "<=1.13.0"}, "RULE-CVE-2026-73382-01": {"action": "init", "conditions": [{"name": "ARGS:_rendered", "type": "exists"}, {"type": "missing_capability", "value": "create_posts"}], "cve": "CVE-2026-73382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73382", "description": "Site Reviews <=8.2.0 reported unauthenticated XSS; only grounded evidence is the REST review-creation _rendered field gated by create_posts capability (advisory-vs-code contradiction unresolved, no source-to-sink trace, REST route not statically literal, capability backstop only)", "mode": "block", "severity": 7.1, "slug": "site-reviews", "tags": ["xss", "rest-api", "authorization-contradiction"], "target": "plugin", "versions": "<=8.2.0"}, "RULE-CVE-2026-73992-01": {"ajax_action": "qw_form_ajax", "conditions": [{"name": "ARGS:form", "type": "equals", "value": "preview"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-73992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73992", "description": "Query Wrangler <=1.5.57 registers qw_form_ajax on wp_ajax_ only (no nopriv), so any logged-in user reaches it. The preview branch urldecode()s the options parameter and parse_str()s it into query options that reach three callable sinks gated only by function_exists(): includes/fields/callback_field.php:29 (custom_output_callback), includes/filters/post_id.php:56 (post_ids_callback) and includes/filters/callback.php:57 (callback). 1.5.58 fixes it by requiring edit_others_posts on the whole endpoint, which is what this rule enforces. Matching the sink names instead is not viable: admin/ajax.php:11 urldecode()s options a SECOND time after PHP already form-decoded it, while the engine reads $_POST, so any sink name survives one extra percent-encoding layer (custom_output_%2563allback) and the real wire format of the third sink is %5Bcallback%5D, which no literal [callback] pattern can match.", "method": "POST", "mode": "block", "severity": 9.9, "slug": "query-wrangler", "tags": ["remote-code-execution", "authenticated", "missing-capability"], "target": "plugin", "versions": "<=1.5.57"}, "RULE-CVE-2026-73994-01": {"ajax_action": "charitable_update_debug_window_ajax", "conditions": [{"type": "missing_capability", "value": "manage_charitable_settings"}], "cve": "CVE-2026-73994", "description": "Charitable <=1.8.11.3 unauthenticated access to debug window AJAX handler via missing authorization on charitable_update_debug_window_ajax", "mode": "block", "severity": 7.5, "slug": "charitable", "target": "plugin", "versions": "<=1.8.11.3"}, "RULE-CVE-2026-73996-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/masteriyo/pro/v1/certificate-pdf-email[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-73996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73996", "description": "Masteriyo LMS <=2.3.2 unauthenticated arbitrary file upload via certificate-pdf-email REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["arbitrary-file-upload", "unauthenticated", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2026-73996-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/masteriyo/pro/v1/certificate-pdf-email[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-73996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73996", "description": "Masteriyo LMS <=2.3.2 unauthenticated arbitrary file upload via certificate-pdf-email REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["arbitrary-file-upload", "unauthenticated", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2026-73997-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/kadence-starter-library/v1/process_images[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:sizes[50]", "type": "exists"}], "cve": "CVE-2026-73997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73997", "description": "Starter Templates by Kadence WP <=2.3.3 unauthenticated denial of service via unbounded image sizes array in process_images REST endpoint", "mode": "block", "severity": 7.5, "slug": "kadence-starter-templates", "tags": ["denial-of-service", "resource-exhaustion", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-73997-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/kadence-starter-library/v1/process_images[\\\\\\\\/]*$~i"}, {"name": "ARGS:sizes[50]", "type": "exists"}], "cve": "CVE-2026-73997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73997", "description": "Starter Templates by Kadence WP <=2.3.3 unauthenticated denial of service via unbounded image sizes array in process_images REST endpoint", "mode": "block", "severity": 7.5, "slug": "kadence-starter-templates", "tags": ["denial-of-service", "resource-exhaustion", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-7465-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (classic editor)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7465-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (REST API)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-74851-01": {"ajax_action": "pods_admin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-74851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74851", "description": "Pods <3.3.9.1 unauthenticated access to pods_admin AJAX handler (wp_ajax_nopriv_pods_admin) removed in 3.3.9.1 hardening", "mode": "block", "severity": 7.2, "slug": "pods", "tags": ["missing-authorization", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<3.3.9.1"}, "RULE-CVE-2026-74851-02": {"ajax_action": "pods_admin_components", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-74851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74851", "description": "Pods <3.3.9.1 unauthenticated access to pods_admin_components AJAX handler (wp_ajax_nopriv_pods_admin_components) removed in 3.3.9.1 hardening", "mode": "block", "severity": 7.2, "slug": "pods", "tags": ["missing-authorization", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<3.3.9.1"}, "RULE-CVE-2026-74992-01": {"ajax_action": "kirki_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "regex", "value": "~(?:upload[_-]?font[_-]?zip|upload[_-]?fonts?)~i"}], "cve": "CVE-2026-74992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74992", "description": "Kirki <=6.2.2 authenticated (Editor+) unrestricted custom-font archive upload leading to stored XSS/RCE via kirki_post_apis AJAX endpoint dispatch", "mode": "block", "severity": 6.8, "slug": "kirki", "tags": ["unrestricted-file-upload", "stored-xss", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2026-74992-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "regex", "value": "~(?:upload[_-]?font[_-]?zip|upload[_-]?fonts?)~i"}], "cve": "CVE-2026-74992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74992", "description": "Kirki <=6.2.2 authenticated (Editor+) unrestricted custom-font archive upload leading to stored XSS/RCE via kirki_wp_admin_post_apis AJAX endpoint dispatch", "mode": "block", "severity": 6.8, "slug": "kirki", "tags": ["unrestricted-file-upload", "stored-xss", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2026-75528-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blc_local"}, {"name": "ARGS:filter_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<\\\\/script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\'\\"]\\\\s*;?\\\\s*(?:alert|eval|prompt|confirm|document\\\\.[a-zA-Z]+)\\\\s*\\\\()~i"}], "cve": "CVE-2026-75528", "description": "Broken Link Checker <=2.4.13 reflected XSS via filter_id parameter on the Links admin page (blc_local), a secondary defect hardened in the same 2.4.13.1 patch that also fixed the primary stored XSS via comment author URL / link log", "mode": "block", "slug": "broken-link-checker", "target": "plugin", "versions": "<=2.4.13"}, "RULE-CVE-2026-75586-01": {"action": "wp", "conditions": [{"name": "ARGS:ucfrontajaxaction", "type": "equals", "value": "submitform"}, {"name": "ARGS:formData[/.*/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg|<iframe)~i"}], "cve": "CVE-2026-75586", "description": "Unlimited Elements For Elementor <=2.0.17 unauthenticated reflected XSS via formData parameter on public wp-hooked submitform handler", "mode": "block", "slug": "unlimited-elements-for-elementor", "target": "plugin", "versions": "<=2.0.17"}, "RULE-CVE-2026-7567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]temp-login-token\\\\[~"}], "cve": "CVE-2026-7567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7567", "description": "Temporary Login <=1.0.0 authentication bypass via non-scalar temp-login-token array parameter", "mode": "block", "severity": 9.8, "slug": "temporary-login", "tags": ["authentication-bypass", "unauthenticated", "cwe-288"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-75796-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/http[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to create privileged accounts via MCP REST endpoint /wp-json/mcp/v1/http missing create_users capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/http[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to create privileged accounts via MCP REST endpoint /wp-json/mcp/v1/http missing create_users capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/http[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to take over arbitrary network accounts via MCP REST endpoint /wp-json/mcp/v1/http missing per-target edit_user capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "account-takeover", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/http[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to take over arbitrary network accounts via MCP REST endpoint /wp-json/mcp/v1/http missing per-target edit_user capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "account-takeover", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75797-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai-ui/v1/editor/submit[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-75797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75797", "description": "AI Engine <3.7.2 missing authorization on /editor/submit REST endpoint allows any nonce-holding authenticated user to invoke the AI editor assistant without a capability check", "mode": "block", "severity": 7.7, "slug": "ai-engine", "tags": ["missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<3.7.2"}, "RULE-CVE-2026-75797-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai-ui/v1/editor/submit[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-75797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75797", "description": "AI Engine <3.7.2 missing authorization on /editor/submit REST endpoint allows any nonce-holding authenticated user to invoke the AI editor assistant without a capability check", "mode": "block", "severity": 7.7, "slug": "ai-engine", "tags": ["missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<3.7.2"}, "RULE-CVE-2026-75981-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~#!trpst#.*?(?:on(?:error|load|click|mouseover|mouseenter|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|\\\\b(?:script|img|svg|iframe|body|input|style|object|embed|marquee)\\\\b).*?#!trpen#~is"}], "cve": "CVE-2026-75981", "description": "TranslatePress <=3.2.5 unauthenticated stored XSS via \'#!trpst#\'/\'#!trpen#\' gettext marker smuggling in wp-comments-post.php comment field", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2026-76053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~___noise___~"}], "cve": "CVE-2026-76053", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76053", "description": "TranslatePress <=3.3.3 unauthenticated stored XSS - forged simple_html_dom \\"___noise___\\" placeholder in comment content is restored into an attribute value, breaking out of the quotes during translation render", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2026-7649-01": {"ajax_action": "arm_directory_paging_action", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:--|#)(?:\\\\s|$)|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\b.*\\\\bWHEN\\\\b|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\()~i"}], "cve": "CVE-2026-7649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7649", "description": "ARMember <=4.0.60 unauthenticated blind SQL injection via orderby parameter", "mode": "block", "severity": 8.8, "slug": "armember-membership", "tags": ["sql-injection", "unauthenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=4.0.60"}, "RULE-CVE-2026-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\{?\\"~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via classic editor post meta (metavalue) leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7654-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[a-zA-Z]~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via REST API post meta leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-76548-01": {"action": "current_screen", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:wppb_upload", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-76548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76548", "description": "Profile Builder <4.0.1 unauthenticated privilege escalation via front-end upload bootstrap grants elevated media/post capabilities", "mode": "block", "severity": 8.2, "slug": "profile-builder", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "file-upload"], "target": "plugin", "versions": ">=3.8.1 <4.0.1"}, "RULE-CVE-2026-76549-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:action", "type": "equals", "value": "updraft_restore"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76549", "description": "UpdraftPlus <1.26.7 CSRF on direct backup-restore dispatch via admin.php?page=updraftplus&action=updraft_restore", "mode": "block", "severity": 5.9, "slug": "updraftplus", "tags": ["csrf", "missing-authorization", "backup-restore"], "target": "plugin", "versions": "<1.26.7"}, "RULE-CVE-2026-76549-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:action", "type": "equals", "value": "updraft_restore_continue"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76549", "description": "UpdraftPlus <1.26.7 CSRF on direct backup-restore-continue dispatch via admin.php?page=updraftplus&action=updraft_restore_continue", "mode": "block", "severity": 5.9, "slug": "updraftplus", "tags": ["csrf", "missing-authorization", "backup-restore"], "target": "plugin", "versions": "<1.26.7"}, "RULE-CVE-2026-76550-01": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS:/fileName|fileDir|extra_copy_path/", "type": "regex", "value": "~(?:\\\\.\\\\.|\\\\x00|:)~"}], "cve": "CVE-2026-76550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76550", "description": "WP Import Export Lite <=3.9.33 authenticated (export-capability holder) arbitrary file write via unvalidated fileName/fileDir/extra_copy_path in wpie_export_create_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["path-traversal", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2026-76550-02": {"ajax_action": "wpie_export_prepare_file", "conditions": [{"name": "ARGS:/fileName|fileDir|extra_copy_path/", "type": "regex", "value": "~(?:\\\\.\\\\.|\\\\x00|:)~"}], "cve": "CVE-2026-76550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76550", "description": "WP Import Export Lite <=3.9.33 authenticated (export-capability holder) arbitrary file write via unvalidated fileName/fileDir/extra_copy_path in wpie_export_prepare_file", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["path-traversal", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2026-76551-01": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_create_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76551-02": {"ajax_action": "wpie_export_update_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_update_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76551-03": {"ajax_action": "wpie_export_save_template", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_save_template", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76554-01": {"ajax_action": "wpie_import_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76554", "description": "WP Import Export Lite <=3.9.34 improper privilege management allows delegated import users to create or modify administrator accounts via wpie_import_data AJAX action", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.34"}, "RULE-CVE-2026-76585-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:review", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave|change|submit)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img[^>]*onerror)~i"}], "cve": "CVE-2026-76585", "description": "Customer Reviews for WooCommerce <5.118.0 unauthenticated stored XSS via review parameter in cr_submit_review AJAX action", "mode": "block", "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.118.0"}, "RULE-CVE-2026-7660-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "easy-updates-manager"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:img|svg|iframe|object|embed|details|body|input|select|textarea|form|marquee|a)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-7660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7660", "description": "Easy Updates Manager <=9.0.20 reflected XSS via paged parameter in pagination()", "method": "GET", "mode": "block", "severity": 6.1, "slug": "stops-core-theme-and-plugin-updates", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.0.20"}, "RULE-CVE-2026-77233-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?=.*google_ad_(?:client|slot|width|height)\\\\s*=)(?=.*pagead2\\\\.googlesyndication\\\\.com/pagead/show_ads\\\\.js)~is"}], "cve": "CVE-2026-77233", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77233", "description": "iubenda Cookie Law Solution <=3.13.4 unauthenticated stored XSS via WordPress comment content triggering legacy AdSense regex rewrite in the Secondary parser engine", "mode": "block", "severity": 7.2, "slug": "iubenda-cookie-law-solution", "tags": ["xss", "stored", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=3.13.4"}, "RULE-CVE-2026-77752-01": {"ajax_action": "wtlwp_enable_one_click_login", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_network"}], "cve": "CVE-2026-77752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77752", "description": "Temporary Login Without Password <1.9.9 network super-admin privilege escalation via wtlwp_enable_one_click_login AJAX handler\'s unguarded update_user() call", "mode": "block", "severity": 7.2, "slug": "temporary-login-without-password", "tags": ["privilege-escalation", "missing-authorization", "multisite"], "target": "plugin", "versions": "<1.9.9"}, "RULE-CVE-2026-77770-01": {"ajax_action": "mo_two_factor_ajax", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-77770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77770", "description": "miniOrange 2FA <6.3.1 unauthenticated arbitrary site-option deletion via mo_two_factor_ajax AJAX action missing authorization", "mode": "block", "severity": 10.0, "slug": "miniorange-2-factor-authentication", "tags": ["missing-authorization", "unauthenticated", "option-deletion"], "target": "plugin", "versions": "<6.3.1"}, "RULE-CVE-2026-77770-02": {"ajax_action": "mo_two_factor_ajax", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-77770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77770", "description": "miniOrange 2FA >=18.0 <19.3 unauthenticated arbitrary site-option deletion via mo_two_factor_ajax AJAX action missing authorization", "mode": "block", "severity": 10.0, "slug": "miniorange-2-factor-authentication", "tags": ["missing-authorization", "unauthenticated", "option-deletion"], "target": "plugin", "versions": ">=18.0 <19.3"}, "RULE-CVE-2026-77782-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/getHead(?:[/?]|$)~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2026-77782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77782", "description": "Rank Math SEO <1.0.277.1 discloses password-protected post content via publicly generated SEO metadata reachable through the headless getHead REST endpoint; endpoint-scoping only, no exploit-specific payload signal is groundable from current evidence", "mode": "block", "severity": 5.3, "slug": "seo-by-rank-math", "tags": ["information-disclosure", "unauthenticated", "needs-human-review"], "target": "plugin", "versions": "<1.0.277.1"}, "RULE-CVE-2026-77830-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\'][^\\"\'<>]{0,40}(?:on\\\\w+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-77830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77830", "description": "CleanTalk Spam Protection, Antispam, FireWall by CleanTalk <=6.86 stored XSS via comment-content attribute breakout of ContactsEncoder aria-label placeholder", "mode": "block", "severity": 7.2, "slug": "cleantalk-spam-protect", "tags": ["xss", "stored", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=6.86"}, "RULE-CVE-2026-7795-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through classic editor post.php", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-7795-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-78003-01": {"ajax_action": "add_list", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~addresses\\\\[[^\\\\]]*(?:/|%2f|%2e%2e|\\\\.\\\\.)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-78003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78003", "description": "Mailgun for WordPress <=2.2.0 unauthenticated SSRF via path traversal in addresses[] array key in add_list AJAX handler", "mode": "block", "severity": 9.8, "slug": "mailgun", "tags": ["ssrf", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2026-78006-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*wp:legacy-widget\\\\b[^>]*\\"idBase\\"\\\\s*:\\\\s*\\"tribe-widget-[^\\"]*\\"[^>]*\\"encoded\\"\\\\s*:\\\\s*\\"[^\\"]+\\"[^>]*\\"hash\\"\\\\s*:\\\\s*\\"[^\\"]+\\"~i"}], "cve": "CVE-2026-78006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78006", "description": "The Events Calendar <=6.17.4 unauthenticated PHP object injection via forged widget-instance block markup in comment content later processed by do_blocks() on the single-event template", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "tags": ["object-injection", "deserialization", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=6.17.4"}, "RULE-CVE-2026-78159-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "contains", "value": "wp:legacy-widget"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\"classes\\"\\\\s*:\\\\s*[\\\\s\\\\S]{0,300}?\\\\[\\\\s*\\"[^\\"]{1,100}\\"\\\\s*,\\\\s*\\"[^\\"]{1,100}\\"\\\\s*\\\\]~i"}], "cve": "CVE-2026-78159", "description": "The Events Calendar <=6.17.3 unauthenticated remote code execution via crafted wp:legacy-widget classes callable array submitted through comment content", "mode": "block", "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.17.3"}, "RULE-CVE-2026-78175-01": {"ajax_action": "tutor_save_withdraw_account", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78175", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78175", "description": "Tutor LMS <=4.0.7 authenticated (subscriber+) PHP object injection via serialized payload in withdraw_method_field key names in tutor_save_withdraw_account AJAX handler", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-78175-02": {"ajax_action": "tutor_save_withdraw_account", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78175", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78175", "description": "Tutor LMS <=4.0.7 authenticated (subscriber+) PHP object injection via serialized payload values submitted to tutor_save_withdraw_account AJAX handler", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-78262-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;{}])[OC]:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78262", "description": "WP Project Manager <4.0.7 unauthenticated PHP object injection via unserialize() in Comment/Activity model accessors", "mode": "block", "severity": 9.8, "slug": "wedevs-project-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<4.0.7"}, "RULE-CVE-2026-78292-01": {"ajax_action": "hashform_process_entry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78292", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78292", "description": "Hash Form <=1.4.1 unauthenticated PHP Object Injection via hashform_process_entry form submission", "mode": "block", "severity": 9.8, "slug": "hash-form", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2026-78295-01": {"ajax_action": "xagio_announcements", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-78295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78295", "description": "Xagio SEO <=7.1.0.43 CSRF via xagio_announcements AJAX handler lacking nonce and capability checks", "mode": "block", "severity": 8.8, "slug": "xagio-seo", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=7.1.0.43"}, "RULE-CVE-2026-78438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~background(?:-image)?\\\\s*:\\\\s*url\\\\s*\\\\(\\\\s*[\'\\"]?\\\\s*(?!https?\\\\s*:)[a-zA-Z][a-zA-Z0-9+.\\\\-]*\\\\s*:~i"}], "cve": "CVE-2026-78438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78438", "description": "W3 Total Cache <=2.10.5 unauthenticated stored XSS via non-http(s) scheme CSS background-image url() in comment content rendered by LazyLoad Background Mutator", "mode": "block", "severity": 7.2, "slug": "w3-total-cache", "tags": ["stored-xss", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=2.10.5"}, "RULE-CVE-2026-80071-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-80071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-80071", "description": "User Registration & Membership <5.2.8 requires authentication for membership AJAX action family (user_registration_membership_$ajax_event) after fix removed anonymous wp_ajax_nopriv_ registration for this dynamic dispatch family", "mode": "block", "severity": 7.2, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<5.2.8"}, "RULE-CVE-2026-8073-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/|(?:^|&|\\\\?)rest_route=/)[^?&]*(?:downloadZIP|download-zip|download_zip)~i"}, {"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter (rest_route query form)", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8089-01": {"ajax_action": "wemail_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wemail_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|animationstart)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|on[a-z]+=))~i"}], "cve": "CVE-2026-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8089", "description": "weMail <2.1.3 reflected XSS via shortcode parameter in wemail_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wemail", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-8096-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_get_apis allows subscriber+ to read sensitive form submission data", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8096-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_post_apis allows subscriber+ to access admin-restricted POST API", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-81271-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?=.*?/geodir/)(?=.*?/markers/)~i"}, {"name": "ARGS:_wpnonce", "type": "exists"}, {"name": "ARGS:_method", "type": "regex", "value": "~^(?!(?:GET|HEAD)$).+~i"}], "cve": "CVE-2026-81271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81271", "description": "GeoDirectory <=2.8.176 unauthenticated CSRF via markers REST route nonce-bypass exception using HTTP method override", "mode": "block", "severity": 8.8, "slug": "geodirectory", "tags": ["csrf", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.8.176"}, "RULE-CVE-2026-81283-01": {"ajax_action": "wpuf_get_child_cat", "conditions": [{"name": "ARGS:/catID|field_attr|form_id/", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-81283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81283", "description": "WP User Frontend <=4.3.10 PHP object injection via wpuf_get_child_cat AJAX unserialize() call", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.3.10"}, "RULE-CVE-2026-81287-01": {"ajax_action": "charitable_report_donor_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81287", "description": "Charitable <=1.8.12.1 subscriber-accessible SQL injection via charitable_report_donor_data AJAX report endpoint (missing capability check)", "mode": "block", "severity": 8.5, "slug": "charitable", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.8.12.1"}, "RULE-CVE-2026-81287-02": {"ajax_action": "charitable_report_donor_data_pagination", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81287", "description": "Charitable <=1.8.12.1 subscriber-accessible SQL injection via charitable_report_donor_data_pagination AJAX report endpoint (missing capability check)", "mode": "block", "severity": 8.5, "slug": "charitable", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.8.12.1"}, "RULE-CVE-2026-81290-01": {"ajax_action": "es_add_subscriber", "conditions": [{"name": "ARGS:es", "type": "regex", "value": "~^(?:[a-z][a-z0-9+.\\\\-]*:)?[\\\\\\\\/]{2}~i"}], "cve": "CVE-2026-81290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81290", "description": "Email Subscribers & Newsletters <=5.9.33 unauthenticated open redirect via es parameter in es_add_subscriber AJAX handler", "mode": "block", "severity": 7.1, "slug": "email-subscribers", "tags": ["open-redirect", "unauthenticated"], "target": "plugin", "versions": "<=5.9.33"}, "RULE-CVE-2026-81291-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:uncode_bread_bg_image", "type": "regex", "value": "~(?:javascript\\\\s*:|[\'\\"]\\\\s*\\\\)\\\\s*;?\\\\s*[\\"\']|<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-81291", "description": "Uncode theme <2.12.8 unauthenticated stored XSS via unsanitized uncode_bread_bg_image breadcrumb background image post meta", "mode": "block", "slug": "uncode", "target": "theme", "versions": "<2.12.8"}, "RULE-CVE-2026-81293-01": {"ajax_action": "wpda_global_replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81293", "description": "WP Data Access <=5.5.81 authenticated SQL injection via wpda_global_replace AJAX action reaching WPDA_Global_Search::replace with no capability check", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.5.81"}, "RULE-CVE-2026-81295-01": {"ajax_action": "ucp_submit_support_message", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81295", "description": "Under Construction <=5.82 authenticated missing-authorization on ucp_submit_support_message AJAX handler", "mode": "block", "severity": 7.1, "slug": "under-construction-page", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=5.82"}, "RULE-CVE-2026-8163-01": {"ajax_action": "infility_redirect", "conditions": [{"name": "ARGS:RId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8163", "description": "Infility Global <2.15.19 authenticated (Subscriber+) SQL injection via RId parameter in infility_redirect AJAX handler", "mode": "block", "severity": 8.8, "slug": "infility-global", "target": "plugin", "versions": "<2.15.19"}, "RULE-CVE-2026-81650-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "manage-galleries"}, {"name": "ARGS:bulkaction", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81650", "description": "NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) <4.5.0 missing authorization on bulkaction parameter in legacy manage-galleries admin page", "mode": "block", "severity": 7.2, "slug": "nextgen-gallery", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<4.5.0"}, "RULE-CVE-2026-8172-01": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_name parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-02": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_email parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-03": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_message", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_message parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-04": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_subject", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_subject parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-81766-01": {"ajax_action": "rsp_upgrade_install_plugin", "conditions": [{"name": "ARGS:download_link", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-81766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81766", "description": "Really Simple Security <9.8.0 subsite administrator privilege escalation via unauthorized plugin install in rsp_upgrade_install_plugin AJAX handler", "mode": "block", "severity": 6.6, "slug": "really-simple-ssl", "tags": ["missing-authorization", "privilege-escalation", "multisite", "plugin-installation"], "target": "plugin", "versions": "<9.8.0"}, "RULE-CVE-2026-81766-02": {"ajax_action": "rsp_upgrade_activate_plugin", "conditions": [{"name": "ARGS:plugin", "type": "exists"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-81766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81766", "description": "Really Simple Security <9.8.0 subsite administrator privilege escalation via unauthorized plugin activation in rsp_upgrade_activate_plugin AJAX handler", "mode": "block", "severity": 6.6, "slug": "really-simple-ssl", "tags": ["missing-authorization", "privilege-escalation", "multisite", "plugin-activation"], "target": "plugin", "versions": "<9.8.0"}, "RULE-CVE-2026-81770-01": {"ajax_action": "csf-export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81770", "description": "Interactive Geo Maps <=1.6.30 missing capability check on csf-export AJAX handler discloses arbitrary stored WordPress options", "mode": "block", "severity": 7.1, "slug": "interactive-geo-maps", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=1.6.30"}, "RULE-CVE-2026-81780-01": {"ajax_action": "hashform_file_upload_action", "conditions": [{"name": "ARGS:allowedExtensions", "type": "regex", "value": "~(?:^|[,;])\\\\s*\\\\.?(?:ph(?:p[2-8]?|tml?|t|ar)|pht|phps|s?html?|cgi|pl|py3?|rb|sh|asp|aspx|jsp|jspx|cfm|exe|dll)\\\\s*(?:[,;]|$)~i"}], "cve": "CVE-2026-81780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81780", "description": "Hash Form <=1.4.2 unauthenticated arbitrary file upload via client-controlled allowedExtensions in hashform_file_upload_action AJAX handler", "mode": "block", "severity": 10.0, "slug": "hash-form", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-81806-01": {"ajax_action": "hmwp_passkey_begin", "conditions": [{"name": "ARGS:credential", "type": "regex", "value": "~(?:file|gopher|dict|ftp|php|expect|s3)://|(?:^|[\\"\'@/])(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|169\\\\.254\\\\.169\\\\.254|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[0-1])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3})~i"}], "cve": "CVE-2026-81806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81806", "description": "Hide My WP Ghost <=7.0.09 unauthenticated hmwp_passkey_begin AJAX action (no nonce/capability check) carries a credential parameter inspected here for SSRF-indicative URL schemes and internal-network targets pending confirmed sink evidence", "mode": "block", "severity": 7.2, "slug": "hide-my-wp", "tags": ["ssrf", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=7.0.09"}, "RULE-CVE-2026-82222-01": {"ajax_action": "give_get_donor_comments", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-82222", "description": "GiveWP <=4.16.7.1 unauthenticated PHP object injection via data parameter in give_get_donor_comments AJAX handler", "mode": "block", "severity": 10.0, "slug": "give", "target": "plugin", "versions": "<=4.16.7.1"}, "RULE-CVE-2026-82228-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/xmlrpc\\\\.php~i"}], "cve": "CVE-2026-82228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82228", "description": "SiteGround Security <1.6.7 unauthenticated 2FA bypass via XML-RPC authentication for accounts requiring two-factor authentication", "mode": "block", "severity": 8.1, "slug": "sg-security", "tags": ["authentication-bypass", "two-factor-bypass", "xmlrpc", "unauthenticated"], "target": "plugin", "versions": "<1.6.7"}, "RULE-CVE-2026-82607-01": {"ajax_action": "wppb_ajax_simple_avatar", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^name\\\\[~"}], "cve": "CVE-2026-82607", "description": "Profile Builder <=3.16.1 unrestricted upload via array-type name parameter bypass in wppb_ajax_simple_avatar AJAX handler", "mode": "block", "slug": "profile-builder", "target": "plugin", "versions": ">=3.16.0 <=3.16.1"}, "RULE-CVE-2026-82845-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-82845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82845", "description": "Masteriyo LMS <3.4.1 PHP object injection via unsanitized deserialization of stored metadata", "mode": "block", "severity": 9.9, "slug": "learning-management-system", "tags": ["object-injection", "deserialization", "php-object-injection"], "target": "plugin", "versions": "<3.4.1"}, "RULE-CVE-2026-82884-01": {"action": "admin_init", "conditions": [{"name": "ARGS:aioseo-quick-robots-submitted", "type": "exists"}, {"type": "missing_capability", "value": "aioseo_page_general_settings"}], "cve": "CVE-2026-82884", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82884", "description": "All in One SEO <5.0.0.1 missing authorization on Quick Edit inline robots-meta save (saveRobotsFields) hardened in the same release that fixed contributor-triggered stored XSS in post editor rendering", "mode": "block", "severity": 6.8, "slug": "all-in-one-seo-pack", "tags": ["missing-authorization", "stored-xss", "contributor", "quick-edit"], "target": "plugin", "versions": "<5.0.0.1"}, "RULE-CVE-2026-82884-02": {"action": "admin_init", "conditions": [{"name": "ARGS:aioseo-bulk-robots-submitted", "type": "exists"}, {"type": "missing_capability", "value": "aioseo_page_general_settings"}], "cve": "CVE-2026-82884", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82884", "description": "All in One SEO <5.0.0.1 missing authorization on Bulk Edit robots-meta save (saveRobotsFields) hardened in the same release that fixed contributor-triggered stored XSS in post editor rendering", "mode": "block", "severity": 6.8, "slug": "all-in-one-seo-pack", "tags": ["missing-authorization", "stored-xss", "contributor", "bulk-edit"], "target": "plugin", "versions": "<5.0.0.1"}, "RULE-CVE-2026-82970-01": {"ajax_action": "gcc_update_imported_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-82970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82970", "description": "GDPR Cookie Consent <=4.4.1 authenticated arbitrary file upload via gcc_update_imported_settings AJAX action missing capability check", "mode": "block", "severity": 10.0, "slug": "gdpr-cookie-consent", "tags": ["arbitrary-file-upload", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2026-83561-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment_post_ID", "type": "exists"}, {"name": "ARGS:comment", "type": "regex", "value": "~elementor-widget-(?:facebook|twitter)-[^\\"\']{0,200}?data-href\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*>|<script|on\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2026-83561", "description": "Complianz GDPR/CCPA Cookie Consent Banner <=7.5.4 unauthenticated stored XSS via comment content abusing Elementor cookie blocker Facebook/Twitter widget regex detection", "mode": "block", "slug": "complianz-gdpr", "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2026-83627-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:Cookie", "type": "regex", "value": "~wphb_cache_[^;=]*(?:<\\\\?|%3[Cc]%3[Ff])~i"}], "cve": "CVE-2026-83627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-83627", "description": "Hummingbird Performance <=3.21.0 unauthenticated remote code execution via wphb_cache_ cookie name PHP tag injection", "mode": "block", "severity": 9.8, "slug": "hummingbird-performance", "tags": ["remote-code-execution", "code-injection", "unauthenticated", "log-poisoning"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-83627-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wphb-logs/page-caching-log\\\\.php~i"}], "cve": "CVE-2026-83627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-83627", "description": "Hummingbird Performance <=3.21.0 unauthenticated direct access to page-caching-log.php RCE payload execution", "mode": "block", "severity": 9.8, "slug": "hummingbird-performance", "tags": ["remote-code-execution", "unauthenticated", "log-poisoning"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-8365-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages|[a-z_-]+)/[0-9]+~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-8365", "description": "Blocksy <=2.1.41 authenticated PHP Object Injection via blocksy_meta REST field leading to RCE", "mode": "block", "severity": 8.8, "slug": "blocksy", "target": "theme", "versions": "<=2.1.41"}, "RULE-CVE-2026-8379-01": {"action": "init", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-8379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8379", "description": "Frontend File Manager Plugin <=23.6 unauthenticated file download via IDOR on file_id parameter", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=23.6"}, "RULE-CVE-2026-8382-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_title", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post title overwrite via _post_title in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8382-02": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_content", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post content overwrite via _post_content in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-84021-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_button\\\\b[^\\\\]]{0,300}?url\\\\s*=\\\\s*(?:&quot;|\\"|\')[^\\"\'&]{0,60}(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|vbscript|data|%6a%61%76%61%73%63%72%69%70%74|&#0*106;|&#x0*6a;)[\\\\x00-\\\\x20]*:~i"}], "cve": "CVE-2026-84021", "description": "Bold Page Builder <5.9.8 contributor+ stored XSS via obfuscated dangerous URL scheme in bt_bb_button shortcode saved through bt_bb_fe_save", "mode": "block", "slug": "bold-page-builder", "target": "plugin", "versions": "<5.9.8"}, "RULE-CVE-2026-84028-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*(?:\\"[^\\"]*(?:\'|<[a-zA-Z]|on\\\\w+\\\\s*=|javascript\\\\s*:)|\'[^\']*(?:\\"|<[a-zA-Z]|on\\\\w+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2026-84028", "description": "Bold Page Builder <5.9.9 stored XSS via unsanitized additional_settings shortcode attribute submitted through bt_bb_fe_save AJAX save handler", "mode": "block", "slug": "bold-page-builder", "target": "plugin", "versions": "<5.9.9"}, "RULE-CVE-2026-84219-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~&(?:Lt|lT|LT|Gt|gT|GT);~"}], "cve": "CVE-2026-84219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84219", "description": "Kirki <6.3.0 stored XSS via case-variant HTML entity spellings bypassing render-time entity holdback in comment content", "mode": "block", "severity": 7.5, "slug": "kirki", "tags": ["xss", "stored", "unauthenticated", "entity-decoding-bypass"], "target": "plugin", "versions": "<6.3.0"}, "RULE-CVE-2026-8438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C(?:script|img|svg|iframe|object|embed|details|body|input|form|link|meta|style|marquee|video|audio|math|a(?:%20|\\\\+|%09|/|%2F))(?:%20|%09|%0[aAdD]|\\\\+|%3E|%2F|/)~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded HTML tags in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C[a-zA-Z][^%]*(?:%20|\\\\+|%09|/)on(?:error|load|click|mouseover|focus|blur|submit|change|input|animationend|toggle)%3D~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded event handler in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-84738-01": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:content_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via content_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84738-02": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:widget_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via widget_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84738-03": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:customizer_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via customizer_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84752-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rtmhub_callback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-84752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84752", "description": "RTMKit (Rometheme for Elementor) <=2.1.5 missing authorization on connector callback exchange (admin-post rtmhub_callback) enabling contributor-level PHP Object Injection chain", "mode": "block", "severity": 8.8, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "object-injection", "authenticated"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2026-84753-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[^\\"]*\\":[0-9]+:{~"}], "cve": "CVE-2026-84753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84753", "description": "Mail Mint <=1.31.0 unauthenticated PHP object injection via untrusted unserialize() call (sink file/line and reaching entrypoint not attributed in available evidence; hardened in 1.31.1)", "mode": "block", "severity": 9.8, "slug": "mail-mint", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.31.0"}, "RULE-CVE-2026-84759-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:/dateshow|capshow|usershow|typeshow|showaction|sourceshow/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84759", "description": "Activity Log <=2.13.1 CSRF-induced reflected XSS via unsanitized admin page filter parameters (dateshow/capshow/usershow/typeshow/showaction/sourceshow)", "mode": "block", "slug": "aryo-activity-log", "target": "plugin", "versions": "<=2.13.1"}, "RULE-CVE-2026-84761-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/litespeed/v3/err_domains[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/main_domain|alias/", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|sftp|ldap|php|expect|jar|s3|glusterfs)://|^(?:https?://)?(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|\\\\[::1\\\\]|\\\\[fd[0-9a-f]{2}:))~i"}], "cve": "CVE-2026-84761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84761", "description": "LiteSpeed Cache <=7.9 unauthenticated SSRF via err_domains REST callback main_domain/alias parameters (is_from_cloud IP check bypass)", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["ssrf", "unauthenticated", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2026-84761-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/litespeed/v3/err_domains[\\\\\\\\/]*$~i"}, {"name": "ARGS:/main_domain|alias/", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|sftp|ldap|php|expect|jar|s3|glusterfs)://|^(?:https?://)?(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|\\\\[::1\\\\]|\\\\[fd[0-9a-f]{2}:))~i"}], "cve": "CVE-2026-84761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84761", "description": "LiteSpeed Cache <=7.9 unauthenticated SSRF via err_domains REST callback main_domain/alias parameters (is_from_cloud IP check bypass)", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["ssrf", "unauthenticated", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2026-84763-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:installed_template", "type": "regex", "value": "~(?:(?:javascript|data|vbscript)\\\\s*:|<\\\\/?script[\\\\s>/]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-84763", "description": "RTMKit (rometheme-for-elementor) <=2.1.5 unauthenticated reflected XSS via installed_template parameter on admin template view", "mode": "block", "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2026-84774-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:utm_campaign", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|body|input)[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84774", "description": "WP Statistics <=14.16.11 unauthenticated reflected XSS via utm_campaign parameter rendered in admin report/metabox campaign tooltip", "mode": "block", "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.11"}, "RULE-CVE-2026-84813-01": {"action": "init", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT|\'\\\\s*(?:OR|AND|UNION)\\\\b|(?:OR|AND)(?:/\\\\*.*?\\\\*/|\\\\s)+[0-9]+\\\\s*=\\\\s*[0-9]+|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2026-84813", "description": "GeoDirectory <=2.8.174 unauthenticated SQL injection via POST email parameter in comment review-count filter", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.174"}, "RULE-CVE-2026-84820-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "view"}, {"name": "ARGS:page", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84820", "description": "Unlimited Elements For Elementor <2.0.18 unauthenticated-delivery reflected XSS via page parameter in form entry admin footer view", "mode": "block", "slug": "unlimited-elements-for-elementor", "target": "plugin", "versions": "<2.0.18"}, "RULE-CVE-2026-84829-01": {"ajax_action": "optml_fetch_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-84829", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84829", "description": "Optimole <4.2.12 authenticated information disclosure via optml_fetch_logs AJAX handler missing capability check (deterministically evidenced authorization gap; documented unauthenticated srcset-attribute XSS path remains unlocalized in available artefacts)", "mode": "block", "severity": 8.8, "slug": "optimole-wp", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<4.2.12"}, "RULE-CVE-2026-84909-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[custom-twitter-feeds\\\\b[^\\\\]]{0,500}?(?:buttoncolor|buttontextcolor|buttontext)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).){0,200}?(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|</style|[{};])~i"}], "cve": "CVE-2026-84909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84909", "description": "Custom Twitter Feeds <=2.8.0 authenticated (contributor+) stored XSS via buttoncolor/buttontextcolor/buttontext legacy shortcode attributes", "mode": "block", "severity": 6.4, "slug": "custom-twitter-feeds", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2026-8494-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8494-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through REST API /wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-85017-01": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85017", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85017", "description": "Unlimited Elements For Elementor <2.0.20 missing capability check on unitecreator_elementor_import_template AJAX action allows subscriber+ PHP object injection via deserialized template data", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["missing-authorization", "object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<2.0.20"}, "RULE-CVE-2026-85116-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/|/wp-login\\\\.php|/wp-cron\\\\.php|/xmlrpc\\\\.php).*$~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[[a-zA-Z_][a-zA-Z0-9_-]*\\\\s+[a-zA-Z_][a-zA-Z0-9_-]*\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~"}], "cve": "CVE-2026-85116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85116", "description": "Simple CAPTCHA with Cloudflare Turnstile >=1.2.2 <1.42.3 unauthenticated arbitrary shortcode execution via do_shortcode() over rendered Contact Form 7 content", "mode": "block", "severity": 6.5, "slug": "simple-cloudflare-turnstile", "tags": ["shortcode-injection", "unauthenticated", "injection"], "target": "plugin", "versions": ">=1.2.2 <1.42.3"}, "RULE-CVE-2026-85130-01": {"ajax_action": "gdpr_log_consent_action", "conditions": [{"name": "ARGS:/subSiteId|currentSite|gdpr_user_action|cookie_list|consent_forward/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|</script|document\\\\.(?:cookie|write|location)|window\\\\.(?:location|open)|[\\"\'`]\\\\s*[;)]\\\\s*(?:alert|eval|document|window|javascript))~i"}], "cve": "CVE-2026-85130", "description": "WPLP Cookie Consent <4.4.4 unauthenticated stored XSS via gdpr_log_consent_action consent-log fields (multisite only)", "mode": "block", "severity": 8.8, "slug": "gdpr-cookie-consent", "target": "plugin", "versions": "<4.4.4"}, "RULE-CVE-2026-85414-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~custom_settings\\\\s*=\\\\s*[\'\\"]?[^\'\\"><]*(?:<script[^>]*>|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|&(?:lt|#x3c|#60);)~i"}], "cve": "CVE-2026-85414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85414", "description": "FooGallery <=3.3.2 contributor+ stored XSS via custom_settings shortcode attribute in post content", "mode": "block", "severity": 6.4, "slug": "foogallery", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-85530-01": {"ajax_action": "give_confirm_email_for_donations_access", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:<[^>]*>|[\\\\x00-\\\\x1F]|[ ]{2,})~"}], "cve": "CVE-2026-85530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85530", "description": "GiveWP <4.16.8.1 unauthenticated donor identity resolution mismatch via anomalous email parameter in give_confirm_email_for_donations_access enabling account takeover", "mode": "block", "severity": 8.1, "slug": "give", "tags": ["privilege-escalation", "unauthenticated", "improper-authorization", "account-takeover"], "target": "plugin", "versions": "<4.16.8.1"}, "RULE-CVE-2026-85574-01": {"action": "admin_post_set_unbounce_domains", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85574", "description": "Unbounce Landing Pages >=1.1.1 <1.1.5 missing authorization on set_unbounce_domains allows subscriber+ reverse-proxy target hijack", "mode": "block", "slug": "unbounce", "target": "plugin", "versions": ">=1.1.1 <1.1.5"}, "RULE-CVE-2026-85574-02": {"action": "admin_post_flush_unbounce_pages", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85574", "description": "Unbounce Landing Pages >=1.1.1 <1.1.5 missing authorization on flush_unbounce_pages allows subscriber+ unauthorized cache state change", "mode": "block", "slug": "unbounce", "target": "plugin", "versions": ">=1.1.1 <1.1.5"}, "RULE-CVE-2026-85652-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~album_id\\\\s*=\\\\s*(?:\\"|&quot;|\')[^\\"\'\\\\]]*?(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*.*?\\\\*/|--\\\\s|#)~i"}], "cve": "CVE-2026-85652", "description": "Photo Gallery by 10Web <=1.8.44 author+ stored time-based SQL injection via album_id shortcode attribute", "mode": "block", "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.44"}, "RULE-CVE-2026-85658-01": {"ajax_action": "pp_ajax_editprofile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[[a-zA-Z][a-zA-Z0-9_-]{1,30}(?:\\\\s+[a-zA-Z_][a-zA-Z0-9_-]*\\\\s*=\\\\s*(?:\\"[^\\"]*\\"|\'[^\']*\'))+\\\\s*/?\\\\]~i"}], "cve": "CVE-2026-85658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85658", "description": "ProfilePress (wp-user-avatar) <=4.17.2 authenticated (subscriber+) arbitrary shortcode execution via pp_ajax_editprofile AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-user-avatar", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=4.17.2"}, "RULE-CVE-2026-85680-01": {"action": "um_submit_form_profile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&lt;\\\\s*(?:script|svg|iframe|img)|&#0*60;|&#x0*3c;)~i"}], "cve": "CVE-2026-85680", "description": "Ultimate Member <2.13.1 unauthenticated stored XSS via profile name fields processed by um_convert_tags() during profile submission", "mode": "block", "slug": "ultimate-member", "target": "plugin", "versions": "<2.13.1"}, "RULE-CVE-2026-8623-01": {"ajax_action": "hidedflipRating", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8623", "description": "DearFlip - PDF Flipbook, 3D Flipbook <=2.4.30 missing authorization on hidedflipRating AJAX handler allows any authenticated user to modify plugin option", "mode": "block", "severity": 6.4, "slug": "3d-flipbook-dflip-lite", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.30"}, "RULE-CVE-2026-8625-01": {"ajax_action": "hidedflipRating", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8625", "description": "DearFlip PDF Flipbook <=2.4.30 missing authorization on hidedflipRating AJAX action", "mode": "block", "severity": 6.4, "slug": "3d-flipbook-dflip-lite", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.30"}, "RULE-CVE-2026-86311-01": {"ajax_action": "shortcode_bwg", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*>\\\\s*<|[\\"\']\\\\s*\\\\)\\\\s*;)~i"}], "cve": "CVE-2026-86311", "description": "Photo Gallery by 10Web <=1.8.44 Author+ stored XSS via shortcode attribute values submitted to the shortcode_bwg AJAX handler", "mode": "block", "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.44"}, "RULE-CVE-2026-86406-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~i"}, {"name": "ARGS:current_membership_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-86406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86406", "description": "User Registration & Membership >=4.4.6 <5.2.8 privilege escalation via unauthorized membership purchase AJAX family lacking capability and payment/plan validation", "mode": "block", "severity": 7.5, "slug": "user-registration", "tags": ["privilege-escalation", "missing-authorization", "authenticated"], "target": "plugin", "versions": ">=4.4.6 <5.2.8"}, "RULE-CVE-2026-86444-01": {"action": "init", "conditions": [{"name": "ARGS:lp-order-received", "type": "exists"}, {"name": "ARGS:key", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\'<>])~i"}], "cve": "CVE-2026-86444", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86444", "description": "LearnPress <4.4.7 unauthenticated reflected XSS via key parameter on public order-received page", "mode": "block", "severity": 7.1, "slug": "learnpress", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<4.4.7"}, "RULE-CVE-2026-86583-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:/display_name|nickname/", "type": "regex", "value": "~\\\\\\\\+$~"}], "cve": "CVE-2026-86583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86583", "description": "Import and export users and customers <=2.4.17 privilege escalation via CSV escape-character desync in display_name/nickname profile fields", "mode": "block", "severity": 8.8, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "csv-injection", "authenticated"], "target": "plugin", "versions": "<=2.4.17"}, "RULE-CVE-2026-8705-01": {"ajax_action": "clearsale_total_push", "conditions": [{"name": "ARGS:pagseguro[metodo]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|IF)\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|/\\\\*[^*]*\\\\*/|\\\\bAND\\\\s+\\\\(\\\\s*SELECT\\\\b)~i"}], "cve": "CVE-2026-8705", "description": "ClearSale Total <=3.4.2 unauthenticated SQL injection via pagseguro[metodo] in clearsale_total_push AJAX handler", "mode": "block", "severity": 7.5, "slug": "clearsale-total", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-87067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/xmlrpc\\\\.php~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-87067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87067", "description": "Forminator Forms <1.57.2.1 authenticated PHP object injection via unrestricted class instantiation during XML-RPC request deserialization", "mode": "block", "severity": 8.5, "slug": "forminator", "tags": ["object-injection", "deserialization", "xmlrpc", "remote-code-execution"], "target": "plugin", "versions": "<1.57.2.1"}, "RULE-CVE-2026-87068-01": {"ajax_action": "forminator_save_import_quiz_popup", "conditions": [{"name": "ARGS:importable", "type": "regex", "value": "~\\"(?:user_role|default_role|assigned_role|new_user_role|role)\\"\\\\s*:\\\\s*\\"(?:administrator|editor|author|shop_manager)\\"~i"}], "cve": "CVE-2026-87068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87068", "description": "Forminator Forms >=1.57.0 <1.57.2.1 authenticated privilege escalation via unvalidated registration role in imported quiz (forminator_save_import_quiz_popup)", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["privilege-escalation", "authenticated", "role-manipulation"], "target": "plugin", "versions": ">=1.57.0 <1.57.2.1"}, "RULE-CVE-2026-8719-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/tools(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP tool enumeration via REST API allows low-privilege users to list admin-level tools", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8719-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp-oauth(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP OAuth authorization allows non-admin users to authorize MCP applications", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8761-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/dokan/v1/customers[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-8761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8761", "description": "Dokan (dokan-lite) <=5.0.1 privilege escalation via vendor-only permission check on re-registered dokan/v1/customers REST route", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "idor", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-8761-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/dokan/v1/customers[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-8761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8761", "description": "Dokan (dokan-lite) <=5.0.1 privilege escalation via vendor-only permission check on re-registered dokan/v1/customers REST route", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "idor", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-87902-01": {"action": "init", "conditions": [{"name": "ARGS:pagename", "type": "regex", "value": "~(?:\\\\.|%2e|%252e){2}(?:/|\\\\\\\\|%2f|%5c|%252f|%255c)~i"}], "cve": "CVE-2026-87902", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "description": "Unauthenticated path traversal in WordPress core page-template resolution leading to conditional local file inclusion / RCE (GHSA-7hp8-65ch-5whp, CVSS 9.2). get_page_template() in wp-includes/template.php urldecodes the pagename query var and, when the decoded value differs from the raw value, appends the candidate template page-{pagename_decoded}.php WITHOUT calling validate_file(); locate_template() then resolves that name against the active theme directory and includes it, so a decoded value carrying ../ climbs out of the theme. When the active theme has a top-level directory whose name starts with page- (e.g. page-templates in Twenty Twelve/Fourteen, Neve, Hestia, Sydney) the page- prefix and the trailing .php are consumed by the traversal, allowing inclusion of any readable local .php (pearcmd.php gives RCE where register_argc_argv=On). Reaching the branch requires the query var to still contain a percent sign after WordPress\' own decode, so the traversal is double URL-encoded on the wire. Fixed across all branches at 7.1.2 / 7.0.6 / 6.9.9 / 6.8.10 / ... / 4.7.37 by guarding the decoded branch with validate_file() and constraining locate_template() to the theme directories. This rule matches encoded or literal directory traversal in the pagename argument.", "mode": "block", "severity": 9.2, "tags": ["path-traversal", "lfi", "rce", "wp-core", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.2"}, "RULE-CVE-2026-87902-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]pagename=[^&#]*(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c))~i"}], "cve": "CVE-2026-87902", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "description": "Unauthenticated path traversal in WordPress core page-template resolution leading to conditional local file inclusion / RCE (GHSA-7hp8-65ch-5whp, CVSS 9.2). get_page_template() in wp-includes/template.php urldecodes the pagename query var and, when the decoded value differs from the raw value, appends the candidate template page-{pagename_decoded}.php WITHOUT calling validate_file(); locate_template() then resolves that name against the active theme directory and includes it, so a decoded value carrying ../ climbs out of the theme. When the active theme has a top-level directory whose name starts with page- (e.g. page-templates in Twenty Twelve/Fourteen, Neve, Hestia, Sydney) the page- prefix and the trailing .php are consumed by the traversal, allowing inclusion of any readable local .php (pearcmd.php gives RCE where register_argc_argv=On). Reaching the branch requires the query var to still contain a percent sign after WordPress\' own decode, so the traversal is double URL-encoded on the wire. Fixed across all branches at 7.1.2 / 7.0.6 / 6.9.9 / 6.8.10 / ... / 4.7.37 by guarding the decoded branch with validate_file() and constraining locate_template() to the theme directories. Defence-in-depth carrier: the engine double-decodes REQUEST_URI, so the fully decoded ../ traversal in the pagename carrier is visible even when the argument-level view is still single-encoded. This rule matches a decoded directory-traversal sequence in the pagename request carrier.", "mode": "block", "severity": 9.2, "tags": ["path-traversal", "lfi", "rce", "wp-core", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.2"}, "RULE-CVE-2026-87915-01": {"ajax_action": "pum_sub_form", "conditions": [{"name": "ARGS:values[/.+/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseout)\\\\s*=|javascript\\\\s*:|&#(?:0*106|x0*6a);?)~i"}], "cve": "CVE-2026-87915", "description": "Popup Maker <=1.24.0 unauthenticated stored XSS via values[] array parameter in pum_sub_form AJAX handler", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<=1.24.0"}, "RULE-CVE-2026-87917-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mc4wp/v1/form[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\b(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2026-87917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87917", "description": "MC4WP Mailchimp for WordPress <=4.14.0 unauthenticated reflected XSS via disallowed URL protocol in \'data\' dynamic content tag rendered by the public /mc4wp/v1/form REST endpoint", "mode": "block", "severity": 6.1, "slug": "mailchimp-for-wp", "tags": ["xss", "reflected", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.14.0"}, "RULE-CVE-2026-87917-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mc4wp/v1/form[\\\\\\\\/]*$~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\b(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2026-87917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87917", "description": "MC4WP Mailchimp for WordPress <=4.14.0 unauthenticated reflected XSS via disallowed URL protocol in \'data\' dynamic content tag rendered by the public /mc4wp/v1/form REST endpoint", "mode": "block", "severity": 6.1, "slug": "mailchimp-for-wp", "tags": ["xss", "reflected", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.14.0"}, "RULE-CVE-2026-8809-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_post_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^administrator$~i"}], "cve": "CVE-2026-8809", "description": "ACF Extended <=0.9.2.5 unauthenticated privilege escalation via validation bypass in frontend form _acf_post_id parameter", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.5"}, "RULE-CVE-2026-8848-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pum/v1/connect/install(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8848", "description": "Popup Maker <=1.22.0 missing authorization on REST connect/install endpoint allows editor-level users to install and activate an arbitrary plugin from an attacker-controlled URL, leading to remote code execution", "mode": "block", "severity": 7.2, "slug": "popup-maker", "target": "plugin", "versions": "<=1.22.0"}, "RULE-CVE-2026-8848-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pum/v1/connect/info(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8848", "description": "Popup Maker <=1.22.0 missing authorization on legacy REST connect/info endpoint allows editor-level users to obtain the bearer token later used to satisfy the install endpoint\'s only non-spoofable validation check", "mode": "block", "severity": 7.2, "slug": "popup-maker", "target": "plugin", "versions": "<=1.22.0"}, "RULE-CVE-2026-8901-01": {"ajax_action": "integrazo_fwcrm_form_errorlog_show_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8901", "description": "Integration for Freshsales <=1.0.15 stored XSS via error log - missing capability check on errorlog_show_action allows subscriber+ to trigger stored XSS payloads", "mode": "block", "severity": 7.2, "slug": "crm-integration-freshworks-any-form", "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2026-89064-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_HEADERS:Authorization", "type": "regex", "value": "~^Basic\\\\s+~i"}, {"name": "", "type": "missing_capability", "value": "ai1wm_export_site"}, {"name": "", "type": "missing_capability", "value": "ai1wm_import_site"}], "cve": "CVE-2026-89064", "description": "All-in-One WP Migration and Backup <=7.110 unauthenticated HTTP Basic credential harvesting via unguarded admin_init credential capture in Ai1wm_Main_Controller::init()", "mode": "block", "severity": 5.3, "slug": "all-in-one-wp-migration", "target": "plugin", "versions": "<=7.110"}, "RULE-CVE-2026-89080-01": {"ajax_action": "change_method_to_email", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89080", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89080", "description": "Really Simple Security <9.8.1 missing authorization on change_method_to_email AJAX handler allows resetting another user\'s completed 2FA enrolment via user_id parameter", "mode": "block", "severity": 7.5, "slug": "really-simple-ssl", "tags": ["authentication-bypass", "missing-authorization", "two-factor-authentication", "idor"], "target": "plugin", "versions": "<9.8.1"}, "RULE-CVE-2026-89080-02": {"ajax_action": "resend_email_code_profile", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89080", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89080", "description": "Really Simple Security <9.8.1 missing authorization on resend_email_code_profile AJAX handler allows resetting another user\'s completed 2FA enrolment via user_id parameter", "mode": "block", "severity": 7.5, "slug": "really-simple-ssl", "tags": ["authentication-bypass", "missing-authorization", "two-factor-authentication", "idor"], "target": "plugin", "versions": "<9.8.1"}, "RULE-CVE-2026-8912-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS:form_input", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-8912", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via form_input parameter in post_cg_gallery_form_upload", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-89141-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/simpleTranscribeAudio[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:mediaId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-89141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89141", "description": "AI Engine <=3.7.7 IDOR via mediaId parameter on simpleTranscribeAudio REST endpoint allows subscriber-level access to other users\' private audio transcriptions", "mode": "block", "severity": 6.5, "slug": "ai-engine", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2026-89141-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/simpleTranscribeAudio[\\\\\\\\/]*$~i"}, {"name": "ARGS:mediaId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-89141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89141", "description": "AI Engine <=3.7.7 IDOR via mediaId parameter on simpleTranscribeAudio REST endpoint allows subscriber-level access to other users\' private audio transcriptions", "mode": "block", "severity": 6.5, "slug": "ai-engine", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2026-89274-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[/?[a-zA-Z_][\\\\w-]*(?:\\\\s+[a-zA-Z_][\\\\w-]*\\\\s*=\\\\s*(?:\\"[^\\"]{0,200}\\"|\'[^\']{0,200}\'))+\\\\s*/?\\\\]|\\\\[[a-zA-Z_][\\\\w-]*\\\\s*/\\\\]|\\\\[/[a-zA-Z_][\\\\w-]*\\\\]~i"}], "cve": "CVE-2026-89274", "description": "WP Recipe Maker <=10.8.1 unauthenticated arbitrary shortcode execution via comment_post comment field consumed as reviewBody metadata", "mode": "block", "slug": "wp-recipe-maker", "target": "plugin", "versions": "<=10.8.1"}, "RULE-CVE-2026-89333-01": {"action": "init", "conditions": [{"name": "ARGS:student_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89333", "description": "Tutor LMS <=4.0.8 authenticated IDOR via student_id parameter discloses arbitrary users\' email and phone", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["idor", "broken-access-control", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.0.8"}, "RULE-CVE-2026-89406-01": {"action": "init", "conditions": [{"name": "ARGS:modula_gallery_id", "type": "exists"}, {"name": "ARGS:modula_image_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-89406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89406", "description": "Modula Image Gallery <=3.0.1 unauthenticated disclosure of private gallery/image metadata via modula_gallery_id and modula_image_id GET parameters read on wp_head", "mode": "pass", "severity": 7.5, "slug": "modula-best-grid-gallery", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-89412-01": {"ajax_action": "trp_get_translations_domchanges", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|&lt;\\\\s*script|&#0*60;\\\\s*script|&#x0*3c;\\\\s*script|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-89412", "description": "TranslatePress <=3.3.5 unauthenticated stored XSS via trp_get_translations_domchanges seeding of Translation Memory original strings later rendered via v-html", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-900001-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-anything-on-click/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support / Essential Plugin supply chain attack: unauthenticated RCE via wpos-analytics REST endpoint. Compromised analytics.essentialplugin.com returns malicious serialized PHP object through unserialize() in class-anylc-admin.php, leading to arbitrary file_put_contents (dropper: wp-comments-posts.php, wp-config.php injection). Shared SDK affects 22 plugins (~200k installs). No CVE assigned; tracked as CAMPAIGN-WPOS-SUPPLY-CHAIN.", "method": "POST", "mode": "block", "severity": 10.0, "slug": "popup-anything-on-click", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "ssrf", "backdoor", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-logo-showcase-responsive-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Logo Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-logo-showcase-responsive-slider-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/countdown-timer-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Countdown Timer Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "countdown-timer-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprps-post-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Responsive Recent Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-responsive-recent-post-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-news-and-scrolling-widgets/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP News and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-news-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-slick-slider-and-image-carousel/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Slick Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-slick-slider-and-image-carousel", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/album-and-image-gallery-plus-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Album and Image Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "album-and-image-gallery-plus-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-testimonials-with-rotator-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Testimonial with Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-testimonial-with-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-09": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-blog-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Blog and Widgets plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-blog-and-widgets", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-10": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/blog-designer-post-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Blog Designer for Post and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "blog-designer-for-post-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-11": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/meta-slider-and-carousel-with-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Meta Slider and Carousel plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "meta-slider-and-carousel-with-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-12": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid-and-filter-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Post Grid and Filter Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "post-grid-and-filter-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-13": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timeline-and-history-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Timeline and History Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "timeline-and-history-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-14": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-responsive-faq-with-category-plugin/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP FAQ plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-faq", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-15": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-team-showcase-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Team Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-team-showcase-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-17": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-trending-post-slider-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Trending Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-trending-post-slider-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-18": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-post-creative/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Featured Post Creative plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "featured-post-creative", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-19": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/portfolio-and-projects/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Portfolio and Projects plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "portfolio-and-projects", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-20": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ticker-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Ticker Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "ticker-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-21": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video-gallery-and-player/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in HTML5 Video Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "html5-videogallery-plus-player", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-22": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-featured-content-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Featured Content and Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-featured-content-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-91011-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img[^>]+class=[\\"\'][^\\"\']*(?:\\\\$\\\\{?[0-9]|\\\\\\\\[0-9])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-91011", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-91011", "description": "EWWW Image Optimizer <8.7.7 Author+ stored XSS via unescaped preg_replace backreference in image class attribute during ExactDN page rewrite", "mode": "block", "severity": 6.8, "slug": "ewww-image-optimizer", "tags": ["xss", "stored", "authenticated", "preg-replace-injection"], "target": "plugin", "versions": "<8.7.7"}, "RULE-CVE-2026-9109-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|on(?:error|load|toggle|mouseover|focus|click|change)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img\\\\b[^>]+\\\\bon[a-z]~i"}], "cve": "CVE-2026-9109", "description": "GPTranslate <=2.31 unauthenticated stored XSS via REST API translation storage", "mode": "block", "severity": 7.2, "slug": "gptranslate", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2026-9125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9125-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9134-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through post editor", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9134-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through REST API", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9178-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/user/list/[0-9]+(?:/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:Username", "type": "exists"}], "cve": "CVE-2026-9178", "description": "WP Forms Connector <=1.8 unauthenticated sensitive user data exposure via wp/v3/user/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-9179-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/post/list(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\bCASE\\\\s+WHEN\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|/\\\\*|#)~i"}], "cve": "CVE-2026-9179", "description": "WP Forms Connector <=1.8 unauthenticated SQL injection via order parameter in /wp-json/wp/v3/post/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-92229-01": {"ajax_action": "forminator_load_quiz", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*\\\\]\\\\s*\\\\[|[0-9]\\\\]\\\\[)\\\\s*[a-zA-Z_][\\\\w-]*~i"}], "cve": "CVE-2026-92229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92229", "description": "Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_load_quiz AJAX handler", "mode": "block", "severity": 9.1, "slug": "forminator", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.57.2"}, "RULE-CVE-2026-92229-02": {"ajax_action": "forminator_reload_quiz", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*\\\\]\\\\s*\\\\[|[0-9]\\\\]\\\\[)\\\\s*[a-zA-Z_][\\\\w-]*~i"}], "cve": "CVE-2026-92229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92229", "description": "Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_reload_quiz AJAX handler", "mode": "block", "severity": 9.1, "slug": "forminator", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.57.2"}, "RULE-CVE-2026-92249-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-92249", "description": "Qi Addons For Elementor <=1.11 unauthenticated reflected XSS via \'s\' search parameter reflected by Table of Contents widget heading scan on search results pages", "mode": "block", "slug": "qi-addons-for-elementor", "target": "plugin", "versions": "<=1.11"}, "RULE-CVE-2026-9243-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~carousel_direction[^}]*(?:on(?:focus|blur|mouse(?:over|enter|move|out)|click|dblclick|key(?:down|up|press)|load|error|focusin|focusout|pointerover|touchstart|animationend)\\\\s*=|style\\\\s*=\\\\s*[^\\"]*(?:position|expression))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9243", "description": "The Plus Addons for Elementor <=6.4.15 contributor+ stored XSS via carousel_direction unquoted attribute injection", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.15"}, "RULE-CVE-2026-92540-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "ARGS:form[caller_can_promote_users]", "type": "regex", "value": "~^(?:1|true|on)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-92540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92540", "description": "Import and export users and customers <2.5.2 privilege escalation to administrator via caller_can_promote_users in acui_import_users_batch AJAX handler", "mode": "block", "severity": 7.2, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "missing-authorization", "csv-import"], "target": "plugin", "versions": ">=2.4.16 <2.5.2"}, "RULE-CVE-2026-92541-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-92541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92541", "description": "Import and export users and customers <2.5.2 authenticated create_users role privilege escalation via acui_import_users_batch missing promote_users check", "mode": "block", "severity": 7.2, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<2.5.2"}, "RULE-CVE-2026-92619-01": {"ajax_action": "wpbc_ajax_option_save", "conditions": [{"name": "ARGS:data_name", "type": "regex", "value": "~^(?:default_role|users_can_register|siteurl|home|active_plugins|template|stylesheet|admin_email|wp_user_roles)$~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-92619", "description": "Booking Calendar <=11.8.2 privilege escalation via wpbc_ajax_option_save unrestricted core WordPress option write", "mode": "block", "slug": "booking", "target": "plugin", "versions": "<=11.8.2"}, "RULE-CVE-2026-92714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpdm_duplicate", "type": "exists"}, {"name": "ARGS:__copynonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-92714", "description": "Download Manager <=3.3.68 IDOR in package duplicate() allows Contributor+ to duplicate arbitrary protected packages via wpdm_duplicate/__copynonce on admin_init", "mode": "block", "severity": 6.5, "slug": "download-manager", "target": "plugin", "versions": "<=3.3.68"}, "RULE-CVE-2026-9290-01": {"action": "init", "conditions": [{"name": "ARGS:wpum_profile", "type": "exists"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\. %2[fF]|\\\\.\\\\. %5[cC]|\\\\.\\\\. %252[fF]|%2[eE]%2[eE](?:%2[fF]|%5[cC])|%252[eE]%252[eE]%252[fF]|%00)~"}], "cve": "CVE-2026-9290", "description": "WP User Manager <=2.9.17 unauthenticated LFI via tab query parameter on profile page", "mode": "block", "severity": 7.5, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.17"}, "RULE-CVE-2026-9290-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile/[^/]+/(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\. %2[fF]|\\\\.\\\\. %5[cC]|\\\\.\\\\. %252[fF]|%2[eE]%2[eE](?:%2[fF]|%5[cC])|%252[eE]%252[eE]|%00)~i"}], "cve": "CVE-2026-9290", "description": "WP User Manager <=2.9.17 unauthenticated LFI via tab path segment in profile permalink", "mode": "block", "severity": 7.5, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.17"}, "RULE-CVE-2026-93485-001": {"action": "init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-01", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-01. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-002": {"action": "rest_api_init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-02", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wp/v2/comments[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-02. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-003": {"action": "rest_api_init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-03", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/wp/v2/comments[\\\\\\\\/]*$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-03. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the classic comment submission endpoint (/wp-comments-post.php, comment field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wp/v2/comments[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the REST comment submission endpoint (/wp/v2/comments, URI carrier for pretty and rest_route forms, content field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/wp/v2/comments[\\\\\\\\/]*$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the REST comment submission endpoint (/wp/v2/comments, source-parsed rest_route carrier, content field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/edit\\\\.php~i"}, {"name": "ARGS:qr_checked_in", "type": "regex", "value": "~(?:[\\"\'<>]|javascript\\\\s*:|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-93526", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-93526", "description": "Event Tickets <=5.29.4 unauthenticated reflected XSS via qr_checked_in parameter reflected unescaped in QR check-in admin notice on wp-admin/edit.php", "mode": "block", "severity": 7.1, "slug": "event-tickets", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.29.4"}, "RULE-CVE-2026-93836-01": {"action": "init", "conditions": [{"name": "ARGS:woosb_ids", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-93836", "description": "WPC Product Bundles for WooCommerce <=8.6.6 unauthenticated stored XSS via woosb_ids parameter during add-to-cart/checkout", "mode": "block", "severity": 7.2, "slug": "woo-product-bundle", "target": "plugin", "versions": "<=8.6.6"}, "RULE-CVE-2026-94487-01": {"ajax_action": "pp-roles-add-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-add-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-02": {"ajax_action": "pp-roles-delete-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-delete-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-03": {"ajax_action": "pp-roles-hide-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-hide-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-04": {"ajax_action": "pp-roles-unhide-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-unhide-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94500-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-94500", "description": "ElementsKit Elementor addons Lite <4.0.6 reflected XSS via post_id parameter in ekit_widgetarea_content AJAX handler", "mode": "block", "slug": "elementskit-lite", "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-94504-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:</textarea|<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data:text/html)~i"}], "cve": "CVE-2026-94504", "description": "Ninja Forms <=3.15.3 unauthenticated stored XSS via nf_ajax_submit formData textarea value rendered unescaped in legacy submission editor", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.3"}, "RULE-CVE-2026-95515-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nf-deactivated", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<body[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationend)\\\\s*=|javascript\\\\s*:|&(?:#x?[0-9a-f]+|lt|gt);)~i"}], "cve": "CVE-2026-95515", "description": "Ninja Forms <=3.15.3 unauthenticated reflected XSS via nf-deactivated parameter rendered globally through the admin_notices deactivation notice (user interaction required)", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.3"}, "RULE-CVE-2026-95522-01": {"ajax_action": "edd_get_file_download_link", "conditions": [{"name": "ARGS:/payment_id|download_id|price_id/", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-95522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95522", "description": "Easy Digital Downloads <=3.7.0 Shop Manager SQL injection via non-numeric payment_id/download_id/price_id in edd_get_file_download_link AJAX handler", "mode": "block", "severity": 7.6, "slug": "easy-digital-downloads", "tags": ["sql-injection", "authenticated", "shop-manager", "ajax"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2026-95529-01": {"action": "init", "conditions": [{"name": "ARGS:cff_template_preview", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-95529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95529", "description": "Calculated Fields Form <5.5.1.2 unauthenticated reflected XSS via ftpl/form_id parameters in CPCFF_TEMPLATE_PREVIEW::dispatch template preview endpoint", "mode": "block", "severity": 7.1, "slug": "calculated-fields-form", "tags": ["xss", "reflected", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<5.5.1.2"}, "RULE-CVE-2026-95601-01": {"action": "init", "conditions": [{"name": "ARGS:/aws_filter|pr_stock|type_aws/", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|--\\\\s)~i"}], "cve": "CVE-2026-95601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95601", "description": "Product Filter by WBW <=3.1.7 unauthenticated SQL injection via aws_filter/pr_stock/type_aws front-end filter parameters", "mode": "block", "slug": "woo-product-filter", "target": "plugin", "versions": "<=3.1.7"}, "RULE-CVE-2026-9570-01": {"action": "init", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~[\'\\"><();]|</script|\\\\\\\\x[0-9a-fA-F]{2}~i"}], "cve": "CVE-2026-9570", "description": "Taskbuilder <5.0.8 unauthenticated reflected XSS via page_no parameter in frontend shortcode inline JavaScript", "mode": "block", "severity": 7.1, "slug": "taskbuilder", "target": "plugin", "versions": "<5.0.8"}, "RULE-CVE-2026-9662-01": {"action": "init", "conditions": [{"name": "ARGS:tpf", "type": "exists"}, {"name": "ARGS:tpf", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]|(?:php|phar|data|zip|expect|glob|zlib)://)~i"}], "cve": "CVE-2026-9662", "description": "Recover Exit For WooCommerce <=1.0.3 unauthenticated LFI via tpf POST parameter in recover_exit()", "mode": "block", "severity": 8.1, "slug": "recoverexit-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2026-9702-01": {"ajax_action": "update_locker_from_typ_page", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated parcel-locker destination update via update_locker_from_typ_page AJAX handler", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9702-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/inpost_pl/v1/order/update(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated order update via REST route inpost_pl/v1/order/update with open permission_callback", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9860-01": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:account-id", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in account-id parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-CVE-2026-9860-02": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:api-key", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in api-key parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-WPT-2453-01": {"action": "init", "conditions": [{"name": "ARGS:_chk", "type": "exists"}], "cve": "WPT-2453", "description": "Block Smart Slider 3 Pro 3.5.1.35 supply chain backdoor activation via _chk parameter. The compromised release uses this hidden parameter to receive base64-encoded PHP payloads for remote code execution.", "mode": "block", "severity": 10, "slug": "nextend-smart-slider3-pro", "tags": ["supply-chain", "backdoor", "rce", "unauthenticated"], "target": "plugin", "versions": "3.5.1.35"}, "RULE-WPT-2587-01": {"ajax_action": "sendForm", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "forms"}, {"name": "ARGS_NAMES", "type": "regex", "value": "~^fields\\\\[(?:FIELD_[A-Za-z0-9_-]+)\\\\]$~i"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\']\\\\s*on(?:abort|afterprint|animation(?:cancel|end|iteration|start)|auxclick|before(?:input|match|print|toggle|unload)|blur|cancel|canplay(?:through)?|change|click|close|contextmenu|copy|cuechange|cut|dblclick|drag(?:end|enter|leave|over|start)?|drop|durationchange|emptied|ended|error|focus(?:in|out)?|formdata|hashchange|input|invalid|key(?:down|press|up)|load(?:eddata|edmetadata|start)?|message|mouse(?:down|enter|leave|move|out|over|up|wheel)|offline|online|page(?:hide|show)|paste|pause|play(?:ing)?|pointer(?:cancel|down|enter|leave|move|out|over|up)|popstate|progress|ratechange|reset|resize|scroll(?:end)?|securitypolicyviolation|seek(?:ed|ing)|select|slotchange|stalled|storage|submit|suspend|timeupdate|toggle|touch(?:cancel|end|move|start)|transition(?:cancel|end|run|start)|unload|volumechange|waiting|wheel)\\\\s*=~i"}], "cve": "WPT-2587", "description": "AI Copilot Content Generator form submission hardening", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-copilot-content-generator", "tags": ["xss", "stored-xss", "zero-day"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-WPT-2815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wc-admin/onboarding/themes/install[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "install_themes"}], "cve": "WPT-2815", "description": "WooCommerce onboarding theme-install authorization boundary (install_themes), fixed in 11.0.1", "mode": "block", "slug": "woocommerce", "tags": ["woocommerce", "missing-authorization", "rest-api"], "target": "plugin", "versions": ">=6.5.0 <=11.0.0"}, "TEST-HEARTBEAT": {"action": "init", "conditions": [{"type": "probabilistic", "value": "0.0002"}], "cve": "TEST-HEARTBEAT", "mode": "pass", "severity": 0.1, "target": "core", "versions": ">=1.0.0"}, "TEST-RULE": {"action": "init", "conditions": [{"name": "ARGS:test-rule", "type": "equals", "value": "b3d45e60-53a5-4959-b911-5178baaef7ac"}], "cve": "TEST-CVE", "mode": "block", "severity": 2.0, "target": "core", "versions": ">=1.0.0"}}}', true );<!DOCTYPE html>
<html lang="es" class="no-js">
<head>
		<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<link rel="profile" href="http://gmpg.org/xfn/11">
	<link rel="pingback" href="https://academiadeidiomasabc.com/xmlrpc.php">
	<title>Página no encontrada &#8211; Academia de Idiomas ABC</title>
<meta name='robots' content='noindex, nofollow' />
<link rel='dns-prefetch' href='//fonts.googleapis.com' />
<link rel="alternate" type="application/rss+xml" title="Academia de Idiomas ABC &raquo; Feed" href="https://academiadeidiomasabc.com/feed/" />
<link rel="alternate" type="application/rss+xml" title="Academia de Idiomas ABC &raquo; Feed de los comentarios" href="https://academiadeidiomasabc.com/comments/feed/" />
<style id='wp-img-auto-sizes-contain-inline-css' type='text/css'>
img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px}
/*# sourceURL=wp-img-auto-sizes-contain-inline-css */
</style>
<style id='wp-emoji-styles-inline-css' type='text/css'>

	img.wp-smiley, img.emoji {
		display: inline !important;
		border: none !important;
		box-shadow: none !important;
		height: 1em !important;
		width: 1em !important;
		margin: 0 0.07em !important;
		vertical-align: -0.1em !important;
		background: none !important;
		padding: 0 !important;
	}
/*# sourceURL=wp-emoji-styles-inline-css */
</style>
<style id='wp-block-library-inline-css' type='text/css'>
:root{--wp-block-synced-color:#7a00df;--wp-block-synced-color--rgb:122,0,223;--wp-bound-block-color:var(--wp-block-synced-color);--wp-editor-canvas-background:#ddd;--wp-admin-theme-color:#007cba;--wp-admin-theme-color--rgb:0,124,186;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-10--rgb:0,107,160.5;--wp-admin-theme-color-darker-20:#005a87;--wp-admin-theme-color-darker-20--rgb:0,90,135;--wp-admin-border-width-focus:2px}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root .has-very-light-gray-background-color{background-color:#eee}:root .has-very-dark-gray-background-color{background-color:#313131}:root .has-very-light-gray-color{color:#eee}:root .has-very-dark-gray-color{color:#313131}:root .has-vivid-green-cyan-to-vivid-cyan-blue-gradient-background{background:linear-gradient(135deg,#00d084,#0693e3)}:root .has-purple-crush-gradient-background{background:linear-gradient(135deg,#34e2e4,#4721fb 50%,#ab1dfe)}:root .has-hazy-dawn-gradient-background{background:linear-gradient(135deg,#faaca8,#dad0ec)}:root .has-subdued-olive-gradient-background{background:linear-gradient(135deg,#fafae1,#67a671)}:root .has-atomic-cream-gradient-background{background:linear-gradient(135deg,#fdd79a,#004a59)}:root .has-nightshade-gradient-background{background:linear-gradient(135deg,#330968,#31cdcf)}:root .has-midnight-gradient-background{background:linear-gradient(135deg,#020381,#2874fc)}:root{--wp--preset--font-size--normal:16px;--wp--preset--font-size--huge:42px}.has-regular-font-size{font-size:1em}.has-larger-font-size{font-size:2.625em}.has-normal-font-size{font-size:var(--wp--preset--font-size--normal)}.has-huge-font-size{font-size:var(--wp--preset--font-size--huge)}.has-text-align-center{text-align:center}.has-text-align-left{text-align:left}.has-text-align-right{text-align:right}.has-fit-text{white-space:nowrap!important}#end-resizable-editor-section{display:none}.aligncenter{clear:both}.items-justified-left{justify-content:flex-start}.items-justified-center{justify-content:center}.items-justified-right{justify-content:flex-end}.items-justified-space-between{justify-content:space-between}.screen-reader-text{border:0;clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal!important}.screen-reader-text:focus{background-color:#ddd;clip-path:none;color:#444;display:block;font-size:1em;height:auto;left:5px;line-height:normal;padding:15px 23px 14px;text-decoration:none;top:5px;width:auto;z-index:100000}html :where(.has-border-color){border-style:solid}html :where([style*=border-top-color]){border-top-style:solid}html :where([style*=border-right-color]){border-right-style:solid}html :where([style*=border-bottom-color]){border-bottom-style:solid}html :where([style*=border-left-color]){border-left-style:solid}html :where([style*=border-width]){border-style:solid}html :where([style*=border-top-width]){border-top-style:solid}html :where([style*=border-right-width]){border-right-style:solid}html :where([style*=border-bottom-width]){border-bottom-style:solid}html :where([style*=border-left-width]){border-left-style:solid}html :where(img[class*=wp-image-]){height:auto;max-width:100%}:where(figure){margin:0 0 1em}html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:var(--wp-admin--admin-bar--height,0px)}@media screen and (max-width:600px){html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:0px}}

/*# sourceURL=wp-block-library-inline-css */
</style>
<style id='classic-theme-styles-inline-css' type='text/css'>
/*! This file is auto-generated */
.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}
/*# sourceURL=/wp-includes/css/classic-themes.min.css */
</style>
<style id='global-styles-inline-css' type='text/css'>
:root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgb(6,147,227) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgb(252,185,0) 0%,rgb(255,105,0) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgb(255,105,0) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgb(255, 255, 255), 6px 6px rgb(0, 0, 0);--wp--preset--shadow--crisp: 6px 6px 0px rgb(0, 0, 0);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
/*# sourceURL=global-styles-inline-css */
</style>

<link rel='stylesheet' id='linear-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/linearicons/linear.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='masterstudy-bootstrap-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/bootstrap.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='masterstudy-bootstrap-custom-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/ms-bootstrap-custom.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-awesome-min-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/font-awesome.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-icomoon-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/icomoon.fonts.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-icomoon-rtl-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/rtl_demo/style.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='select2-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/select2.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='fancybox-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/jquery.fancybox.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='animate-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/animate.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/styles.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-stm_layout_styles-language_center-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/stm_layout_styles/language_center.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_animation-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/animation.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-headers-header_default-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/headers/header_default.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-headers_transparent-header_default_transparent-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/headers_transparent/header_default_transparent.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_style-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/style.css?ver=4.8.9' type='text/css' media='all' />
<style id='stm_theme_style-inline-css' type='text/css'>

			body .ms_lms_loader {
			border-color: #eab830 #eab830 transparent transparent;
			}
			body .ms_lms_loader::after, .ms_lms_loader::before {
			border-color:  transparent transparent #48a7d4 #48a7d4;
			}
@media (max-width: 1025px) {
	    #header .header_top .stm_header_top_toggler {
	     display: none !important;
	    }
	}
@media (max-width: 1025px) {
	    #header .mobile_search_courses {
	     display: none !important;
	    }
	}
/*# sourceURL=stm_theme_style-inline-css */
</style>
<link rel='stylesheet' id='stm_theme_custom_styles-css' href='https://academiadeidiomasabc.com/wp-content/uploads/stm_lms_styles/custom_styles.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_dynamic-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/dynamic.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_fonts-css' href='//fonts.googleapis.com/css?family=Montserrat%7COpen+Sans%3A200%2C300%2C300italic%2C400%2C400italic%2C500%2C600%2C700%26subset%3Dlatin%2Clatin-ext&#038;ver=4.8.9' type='text/css' media='all' />
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script>
<link rel="https://api.w.org/" href="https://academiadeidiomasabc.com/wp-json/" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://academiadeidiomasabc.com/xmlrpc.php?rsd" />
<meta name="generator" content="WordPress 6.9.1" />
	<script>
		var ajaxurl = 'https://academiadeidiomasabc.com/wp-admin/admin-ajax.php';
		var stm_install_plugin = '02c1f7b6ca';
		var stm_buddypress_groups = '2a61f7a2d6';
		var stm_ajax_add_review = 'd2e254ee8e';
	</script>
	<link rel="shortcut icon" type="image/x-icon" href="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/favicon.ico" />
<link rel="icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-32x32.png" sizes="32x32" />
<link rel="icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-192x192.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-180x180.png" />
<meta name="msapplication-TileImage" content="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-270x270.png" />
	</head>
<body class="error404 wp-theme-masterstudy  language_center masterstudy-theme stm_preloader_" ontouchstart="">


<!-- Searchform -->
<div class="modal fade" id="searchModal" tabindex="-1" role="dialog" aria-labelledby="searchModal">
	<div class="modal-dialog" role="document">
		<div class="modal-content">
		
			<div class="modal-body heading_font">
				<div class="search-title">Buscar</div>
				<form role="search" method="get" id="searchform" action="https://academiadeidiomasabc.com/">
				    <div class="search-wrapper">
				        <input placeholder="Escribe algo…" type="text" class="form-control search-input" value="" name="s" id="s" />
				        <button type="submit" class="search-submit" ><i class="fa fa-search"></i></button>
				    </div>
				</form>
			</div>
		
		</div>
	</div>
</div><div id="wrapper">

	
	<div id="header" class="transparent_header_off"
		data-color="">

		
		
		<div class="header_default header_default">
			<div class="container">
    <div class="row">
	    <div class="col-md-3 col-sm-12 col-xs-12">
		    <div class="logo-unit">
                	<a href="https://academiadeidiomasabc.com/"><span class="logo">Academia de Idiomas ABC</span></a>
		    </div>
		    
	        <!-- Navbar toggle MOBILE -->
		    <button type="button" class="navbar-toggle collapsed hidden-lg hidden-md" data-toggle="collapse" data-target="#header_menu_toggler">
				<span class="sr-only">Toggle navigation</span>
				<span class="icon-bar"></span>
				<span class="icon-bar"></span>
				<span class="icon-bar"></span>
			</button>
	    </div> <!-- md-3 -->
	    

	    <!-- MObile menu -->
	    <div class="col-xs-12 col-sm-12 visible-xs visible-sm">
		    <div class="collapse navbar-collapse header-menu-mobile" id="header_menu_toggler">
			    <ul class="header-menu clearfix">
				    <li id="menu-item-5090" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-5090"><a href="https://academiadeidiomasabc.com/">Inicio</a></li>
<li id="menu-item-5179" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5179"><a href="https://academiadeidiomasabc.com/courses-3/">Cursos</a>
<ul class="sub-menu">
	<li id="menu-item-5448" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5448"><a href="https://academiadeidiomasabc.com/cursos-2x1/">Cursos 2×1</a>
	<ul class="sub-menu">
		<li id="menu-item-5765" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5765"><a href="https://academiadeidiomasabc.com/2x1-ninos/">2×1 Niños</a></li>
		<li id="menu-item-5764" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5764"><a href="https://academiadeidiomasabc.com/2x1-adultos-y-adolescentes/">2×1 Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5217" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5217"><a href="https://academiadeidiomasabc.com/cursos-ingles/">Cursos de Inglés</a>
	<ul class="sub-menu">
		<li id="menu-item-5794" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5794"><a href="https://academiadeidiomasabc.com/ingles-de-ninos/">Inglés de Niños</a></li>
		<li id="menu-item-5793" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5793"><a href="https://academiadeidiomasabc.com/ingles-de-adultos-y-adolescentes/">Inglés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5216" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5216"><a href="https://academiadeidiomasabc.com/cursos-frances/">Cursos de Francés</a>
	<ul class="sub-menu">
		<li id="menu-item-5792" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5792"><a href="https://academiadeidiomasabc.com/frances-de-ninos/">Francés de Niños</a></li>
		<li id="menu-item-5791" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5791"><a href="https://academiadeidiomasabc.com/frances-de-adultos-y-adolescentes/">Francés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5369" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5369"><a href="https://academiadeidiomasabc.com/contact-us-2/">Prueba tus conocimientos</a></li>
</ul>
</li>
<li id="menu-item-5091" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-5091"><a href="https://academiadeidiomasabc.com/blog/">Blog ABC</a></li>
<li id="menu-item-5092" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://academiadeidiomasabc.com/about-us-2/">Acerca de Nosotros</a></li>
<li id="menu-item-5093" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5093"><a href="https://academiadeidiomasabc.com/contact-us-2/">Contáctanos</a></li>
                    <li>
                    	<form role="search" method="get" id="searchform-mobile" action="https://academiadeidiomasabc.com/">
						    <div class="search-wrapper">
						        <input placeholder="Buscar..." type="text" class="form-control search-input" value="" name="s" />
						        <button type="submit" class="search-submit" ><i class="fa fa-search"></i></button>
						    </div>
						</form>
                    </li>
			    </ul>
		    </div>
	    </div>
	    
	    <!-- Desktop menu -->
	    <div class="col-md-9 col-sm-9 col-sm-offset-0 hidden-xs hidden-sm">
			
<div class="stm_menu_toggler" data-text="Menú"></div>
<div class="header_main_menu_wrapper clearfix" style="margin-top:5px;">

    <div class="pull-right hidden-xs right_buttons">

		
		            <div class="search-toggler-unit">
                <div class="search-toggler" data-toggle="modal" data-target="#searchModal"><i class="fa fa-search"></i>
                </div>
            </div>
		
					<div class="pull-right">
    <div class="header_top_bar_socs">
        <ul class="clearfix">
                    </ul>
    </div>
</div>		
            </div>

    <div class="collapse navbar-collapse pull-right">
        <ul class="header-menu clearfix">
			<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-5090"><a href="https://academiadeidiomasabc.com/">Inicio</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5179"><a href="https://academiadeidiomasabc.com/courses-3/">Cursos</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5448"><a href="https://academiadeidiomasabc.com/cursos-2x1/">Cursos 2×1</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5765"><a href="https://academiadeidiomasabc.com/2x1-ninos/">2×1 Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5764"><a href="https://academiadeidiomasabc.com/2x1-adultos-y-adolescentes/">2×1 Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5217"><a href="https://academiadeidiomasabc.com/cursos-ingles/">Cursos de Inglés</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5794"><a href="https://academiadeidiomasabc.com/ingles-de-ninos/">Inglés de Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5793"><a href="https://academiadeidiomasabc.com/ingles-de-adultos-y-adolescentes/">Inglés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5216"><a href="https://academiadeidiomasabc.com/cursos-frances/">Cursos de Francés</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5792"><a href="https://academiadeidiomasabc.com/frances-de-ninos/">Francés de Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5791"><a href="https://academiadeidiomasabc.com/frances-de-adultos-y-adolescentes/">Francés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5369"><a href="https://academiadeidiomasabc.com/contact-us-2/">Prueba tus conocimientos</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-5091"><a href="https://academiadeidiomasabc.com/blog/">Blog ABC</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://academiadeidiomasabc.com/about-us-2/">Acerca de Nosotros</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5093"><a href="https://academiadeidiomasabc.com/contact-us-2/">Contáctanos</a></li>
        </ul>
    </div>

</div>	    </div><!-- md-8 desk menu -->
	    
    </div> <!-- row -->
</div> <!-- container -->		</div>
	</div> <!-- id header -->
	
<div id="main">
<div class="error_page">
	<div class="container">
	    <div class="row">
	        <div class="col-md-12">
		        <div class="heading_font">
		            <div class="error_404">404</div>
		            <div class="h2">La página que estás buscando no existe.</div>
		        </div>
		        <a href="https://academiadeidiomasabc.com" class="btn btn-default">REGRESAR A LA PÁGINA PRINCIPAL</a>
	        </div>
	    </div>
	</div>
</div>

           </div>
</div>
		<footer id="footer" class="parallax-off">
			<div class="footer_wrapper">
												
				<div id="footer_copyright">
		<div class="container">
			<div class="row">
				<div class="col-md-6 col-sm-8">
					<div class="clearfix">
													<div class="pull-left">
																	<img class="footer_logo" src="http://lms.loc/unittest/wp-content/themes/masterstudy/assets/img/tmp/footer-logo2x.png" alt="Logo del pie de página"/>
															</div>
																			<div class="copyright_text">Copyright &copy; <a target="_blank" href="https://stylemixthemes.com/masterstudy/">MasterStudy</a> Theme for WordPress by <a target="_blank" href="https://www.stylemixthemes.com/">StylemixThemes</a></div>
											</div>
				</div>
				<div class="col-md-6 col-sm-4">
					<div class="clearfix">
						<div class="pull-right xs-pull-left">
																					<!-- Header top bar Socials -->
															<div class="pull-right">
									<div class="copyright_socials">
										<ul class="clearfix">
																					</ul>
									</div>
								</div>
													</div>
						<div class="pull-right xs-pull-left hidden-sm hidden-xs">
							<ul class="footer_menu heading_font clearfix">
							    						    </ul>
						</div>
					</div>
				</div>
			</div>
		</div>
	</div>
			</div>
		</footer>

        
	<script>
		var cf7_custom_image = 'https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/img/';
		var daysStr = 'Días';
		var hoursStr = 'Horas';
		var minutesStr = 'Minutos';
		var secondsStr = 'Segundos';
	</script>


	<script type="speculationrules">
{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/masterstudy/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}
</script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/bootstrap.min.js?ver=4.8.9" id="masterstudy-bootstrap-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/jquery.fancybox.min.js?ver=4.8.9" id="fancybox-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/select2.full.min.js?ver=4.8.9" id="select2-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/custom.js?ver=4.8.9" id="stm_theme_scripts-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/ajax.submit.js?ver=4.8.9" id="ajaxsubmit-js"></script>
<script id="wp-emoji-settings" type="application/json">
{"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://academiadeidiomasabc.com/wp-includes/js/wp-emoji-release.min.js?ver=6.9.1"}}
</script>
<script type="module">
/* <![CDATA[ */
/*! This file is auto-generated */
const a=JSON.parse(document.getElementById("wp-emoji-settings").textContent),o=(window._wpemojiSettings=a,"wpEmojiSettingsSupports"),s=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const a=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===a[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,a){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!a(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,a){let r;const o=(r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),s=(o.textBaseline="top",o.font="600 32px Arial",{});return e.forEach(e=>{s[e]=t(o,e,n,a)}),s}function r(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}a.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),c.toString(),p.toString()].join(",")+"));",a=new Blob([e],{type:"text/javascript"});const r=new Worker(URL.createObjectURL(a),{name:"wpTestEmojiSupports"});return void(r.onmessage=e=>{i(n=e.data),r.terminate(),t(n)})}catch(e){}i(n=f(s,u,c,p))}t(n)}).then(e=>{for(const n in e)a.supports[n]=e[n],a.supports.everything=a.supports.everything&&a.supports[n],"flag"!==n&&(a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&a.supports[n]);var t;a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&!a.supports.flag,a.supports.everything||((t=a.source||{}).concatemoji?r(t.concatemoji):t.wpemoji&&t.twemoji&&(r(t.twemoji),r(t.wpemoji)))});
//# sourceURL=https://academiadeidiomasabc.com/wp-includes/js/wp-emoji-loader.min.js
/* ]]> */
</script>
	</body>
</html>