Proof of Concept

Bookly ≤ 28.2: unauthenticated IDOR on booking AJAX — bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; calendar export and rollback cancel non-completed bookings. CVSS 3.1 9.1 Critical (CWE-639).

Customer Reviews for WooCommerce (CusRev) ≤ 5.120.0: public review form AJAX accepts arbitrary Media Library attachment IDs; linked files are deleted when the review is purged. CVSS 3.1 9.1 Critical (CWE-862). Requires a /cusrev/{formId}/ link.

Unauthenticated administrator via public WAWP REST signup: unsanitized wawp_custom_fields writes wp_capabilities through update_user_meta. Automation Web Platform plugin ≤ 4.8.6 (CVSS 3.1 9.8 Critical).

Pre-authentication SQL injection in Roundcube Webmail via the virtuser_query plugin and a preg_replace() backslash escape bypass. Affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1 (CVSS 3.1 8.1 HIGH).

Unauthenticated privilege escalation in the WordPress JetFormBuilder plugin (≤ 3.6.2) via the `_jet_engine_booking_form_id` handling path. Attackers may gain elevated capabilities without valid credentials.

Unauthenticated arbitrary shortcode execution in WP Recipe Maker (≤ 10.8.1) through approved recipe rating comments and **reviewBody** JSON-LD handling.

Unauthenticated SQL injection in OrdaSoft **OS Gallery** (`com_osgallery` / `com_osgallery_light` ≤ 6.2.6) via the image **search** parameter (`textsearch`).

Chained unauthenticated privilege escalation to **administrator** in Meta Box AIO (≤ 3.11.0) involving **MB Frontend Submission** (≤ 4.5.6) frontend submission logic.

Unauthenticated PHP object injection in **Give Tributes** (≤ 2.3.1) via unsanitized **eCard multi-recipient** POST data stored on donations (unsafe deserialization on read).

Unauthenticated local file inclusion in **Visual Composer Website Builder** (≤ 45.16.0) via the **`vcv-template`** parameter (public Wordfence/NVD discussion).

Unauthenticated arbitrary shortcode execution in **Forminator** (≤ 1.57.2) via **`current_url`** in quiz-related AJAX handlers.

Unauthenticated arbitrary file upload in **Gravity Forms** (≤ 3.1.0.4) abusing a hidden **File Upload** field (`upload_file`).

Unauthenticated remote code execution in REDCap ≥ 13.3.0 via public survey __passthru routing and Data Import path handling. Patched in 16.0.49, 17.3.10, and 17.4.4+. Requires a valid public survey hash (s=) for the published check/exploit tooling.

Critical WHM/cPanel issue (CVE-2026-41940): pre-authentication bypass chain described in public research, with CVSS ~9.8. Restrict WHM exposure and patch from vendor advisories.