08-06-26, 05:01 AM
Hello darkforums i am selling a WordPress plugins 0day package i will not display the name of all plugins in this thread only some.
All packages have 6k-30k+ (active) installs i will now tell you the capability of these vulnerabilities below. ( yes all 0days yes are on the latest versions)
> Discount oracle + free membership redemption - 0day, novel
This is the paid member subscriptions PMS finding plugin slug paid member subscriptions 10,000+ installs It actually two bugs that chain an information disclosure oracle and a business logic free membership redemption.
> (CWE) reCAPTCHA v3 bypass - 0day, novel
This is the second paid member subscriptions PMS finding slug paid member subscriptions version 10,000+ installs It defeats the plugin's bot protection reCAPTCHA without solving anything.
> 2FA bypass (unvalidated provider) - 0day, novel
Complete bypass of two-factor authentication for any user+ WP 2FA user(on this plugin), including administrators anyone who has users password can authenticate as that user without a second factor leading to account takeover and for an administrator account full site compromise.
> Unauth full-user PII dump - 0day ,novel
20,000+ installs one unauthenticated GET request dumps the entire user table including administrators with emails phone numbers real names and usernames.
> Blind SSRF via oEmbed - 0day ,novel
you get the server to make an HTTP request to a URL you choose (external / metadata)
> Unauth group-member enumeration - 0day,novel
6,000+ installs attacker dumps the membership of any group names sequential user-IDs usernames whole site's userbase, including the admin.
> register_ajax ACL inversion - 0day ,novel
this a different kind of thing from the others It's not an exploitable bug you fire a request at; it's a broken security boundary a single backwards function call that silently disables the plugins entire "logged in only vs logged out only" access control system.
if you are interested i can provide whatever proof needed and i will do my best to answer your questions also looking for partners. i will continue writing up more threads today if you are interested telegram: OilburnerSec or PM me here. (not sure if this is allowed but ill also accept exploit(dot)in forum escrow for my deals we will always USE some type of escrow or TRUSTED MM.
All packages have 6k-30k+ (active) installs i will now tell you the capability of these vulnerabilities below. ( yes all 0days yes are on the latest versions)
> Discount oracle + free membership redemption - 0day, novel
This is the paid member subscriptions PMS finding plugin slug paid member subscriptions 10,000+ installs It actually two bugs that chain an information disclosure oracle and a business logic free membership redemption.
> (CWE) reCAPTCHA v3 bypass - 0day, novel
This is the second paid member subscriptions PMS finding slug paid member subscriptions version 10,000+ installs It defeats the plugin's bot protection reCAPTCHA without solving anything.
> 2FA bypass (unvalidated provider) - 0day, novel
Complete bypass of two-factor authentication for any user+ WP 2FA user(on this plugin), including administrators anyone who has users password can authenticate as that user without a second factor leading to account takeover and for an administrator account full site compromise.
> Unauth full-user PII dump - 0day ,novel
20,000+ installs one unauthenticated GET request dumps the entire user table including administrators with emails phone numbers real names and usernames.
> Blind SSRF via oEmbed - 0day ,novel
you get the server to make an HTTP request to a URL you choose (external / metadata)
> Unauth group-member enumeration - 0day,novel
6,000+ installs attacker dumps the membership of any group names sequential user-IDs usernames whole site's userbase, including the admin.
> register_ajax ACL inversion - 0day ,novel
this a different kind of thing from the others It's not an exploitable bug you fire a request at; it's a broken security boundary a single backwards function call that silently disables the plugins entire "logged in only vs logged out only" access control system.
if you are interested i can provide whatever proof needed and i will do my best to answer your questions also looking for partners. i will continue writing up more threads today if you are interested telegram: OilburnerSec or PM me here. (not sure if this is allowed but ill also accept exploit(dot)in forum escrow for my deals we will always USE some type of escrow or TRUSTED MM.