wp-cve-intel

KO | EN

gitlite — search

#hacktoberfest #react #ai #golang #go #rust #deep-learning #macos #cli #kubernetes #vue #awesome-list #security #pytorch

(★ 46)

No description available.

wp-cve-intel 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# wp-cve-intel

> A public repository of reverse-engineered, high-impact WordPress CVEs — with root-cause analysis, proof-of-concepts, patch diffs, and Nuclei detection templates.

Created and maintained by **[@nahamsec](https://github.com/nahamsec)** (Ben Sadeghipour).

## 📺 Watch the walkthrough

[![Watch the video](https://img.youtube.com/vi/C7TbsqTmzWs/maxresdefault.jpg)](https://www.youtube.com/watch?v=C7TbsqTmzWs)

▶️ **https://www.youtube.com/watch?v=C7TbsqTmzWs**

## What this is

`wp-cve-intel` is my working repository for **reverse-engineered CVEs from WordPress plugins**. Every day, newly disclosed high- and critical-severity WordPress vulnerabilities get pulled, triaged, and — for the ones that actually matter — fully reverse engineered and documented here.

The focus is deliberately narrow: **real, exploitable, high-impact bugs**. That means the collection prioritizes:

- **Unauthenticated** or low-privilege exploitable flaws (not admin-only)
- Plugin vulnerabilities (not themes or WordPress core)
- CVSS 7–10 (High / Critical)
- Impactful classes: SQL injection, RCE, account takeover, auth bypass, stored/reflected XSS, and similar

Lower-risk, admin-only, or theme/core findings are intentionally skipped in favor of quality documentation over volume.

## Repository structure

CVEs are organized by year and CVE ID:

```
<YEAR>/
  CVE-XXXX-XXXXX/
    README.md      # Full technical write-up + root-cause analysis
    report.md      # Vulnerability report details
    poc.md         # Reproducible, lab-based proof-of-concept steps
    changes.diff   # The synthesized patch / one-line fix
    nuclei.yaml    # Nuclei detection template for scanning
```

A typical write-up covers:

- **Identification** — CVE ID, affected plugin, and vulnerable version range
- **Classification** — vulnerability type, CWE, CVSS
- **Root-cause analysis** — annotated code showing the exact source → sink data flow
- **Attack vector** — who can exploit it and how (e.g., unauthenticated)
- **Impact** — what an attacker actually gains
- **Remediation** — the fix, with a patch diff
- **Detection** — a Nuclei template to find affected hosts
- **Proof of Concept** — working, reproducible exploitation steps

## How it's built

The `claude-skill/` directory contains the automation behind the repo — a [Claude Code](https://claude.com/claude-code) skill and daily prompt (`daily_cve_prompt.md`) that:

1. **Discovers** recently disclosed WordPress vulns (CVSS 7–10) from public sources like Patchstack
2. **Filters** down to genuinely exploitable, non-admin-only plugin flaws
3. **Reverse engineers** each one — affected versions, exploitation method, and a plain-language root-cause explanation
4. **Documents** the results into the structured `<YEAR>/<CVE_ID>/` folders and commits them here

## ⚠️ Disclaimer

This repository is for **educational and ethical hacking purposes** only.

## About

Built by **Ben Sadeghipour ([@nahamsec](https://github.com/nahamsec))** — hacker, content creator, and educator.

- 🐦 X/Twitter: [@nahamsec](https://twitter.com/nahamsec)
- 📺 YouTube: [youtube.com/@nahamsec](https://www.youtube.com/@nahamsec)
- 🌐 Website: [nahamsec.com](https://nahamsec.com)

wp-cve-intel

wp-cve-intel 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

wp-cve-intel

wp-cve-intel 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README