Description
WordPress Gutenberg Blocks Plugin /wp-admin/admin-ajax.php 任意文件上传，攻击者可以获取服务器权限
WordPress Gutenberg Blocks Plugin /wp-admin/admin-ajax.php 任意文件上传
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.wordfence.com/blog/2025/07/10000-wordpress-sites-affected-by-critical-vulnerabilities-in-ht-contact-form-wordpress-plugin/
https://github.com/Nxploited/CVE-2025-7340
https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-page-builder-plugin-3-1-10-unauthenticated-arbitry-file-upload-vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2024-9234
https://atomicedge.io/cve-proof/cve-2026-25438-unlimited-blocks-version-1-2-8-medium-vulnerability-proof-of-concept/
https://www.sentinelone.com/vulnerability-database/cve-2026-2633/