CryptoCat

CryptoCat

@cryptocat.me

Security Researcher @rapid7.com 😈 Hacking Content @ https://yt.cryptocat.me 💜

529 followers86 following192 posts

CryptoCat
@cryptocat.me

The same renderer is reachable with no account at all 👀 When the DB goes down Craft decides it isn't installed and reopens the anonymous installer, which hands back CRAFT_SECURITY_KEY so you can sign your own redirect 🔑 cryptocat.me/blog/researc...

cryptocat.meCraft CMS Environment Disclosure to Unauthenticated RCE via Database Fail-Open | CVE-2026-92591 | CryptoCat's BlogHow a database outage makes Craft CMS treat itself as uninstalled, and how the anonymous installer's site-name validation both discloses CRAFT_SECURITY_KEY and renders a redirect signed with it as uns...
CryptoCat
@cryptocat.me

Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑 cryptocat.me/blog/researc...

cryptocat.meUser Registration & Membership Cross-Site Request Forgery to User Approval and Denial | CVE-2026-92978 | CryptoCat's BlogRoot cause analysis of CVE-2026-92978 in User Registration & Membership, where the bulk Approve and Deny actions on the WordPress Users screen never checked a nonce, so any page a logged-in administra...
CryptoCat
@cryptocat.me

Everything seems pretty quiet on the CVE-2026-97229 front, soooo here's a @rapid7.com PoC that turns 248 characters into 2GB+ of Onigmo pcode and reaches system() as GitLab's git user. Requires write access to a public project. github.com/jburgess-r7/...

github.comGitHub - jburgess-r7/CVE-2026-97229-PoC: GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 imageGitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image - jburgess-r7/CVE-2026-97229-PoC
CryptoCat
@cryptocat.me

Writeup about an unauthenticated bug I found in Booking Calendar: make one booking, then read every other customer's name, email and phone. 40k+ active installs, $200 bounty 📅 cryptocat.me/blog/researc...

cryptocat.meBooking Calendar Unauthenticated Customer Data Exposure via a Timeline Booking Hash | CVE-2026-18496 | CryptoCat's BlogRoot cause analysis of CVE-2026-18496 in Booking Calendar, where an unauthenticated visitor replays a hash from their own booking to switch the public timeline's popovers back on and read other custom...
CryptoCat
@cryptocat.me

GeoDirectory only stripped tags when it saw a literal <, so a subscriber could hide stored XSS in a phone field as entity-encoded text and let the Post Badge decode it back. cryptocat.me/blog/researc...

cryptocat.meGeoDirectory Stored XSS via Text-type Custom Field | CVE-2026-93897 | CryptoCat's BlogRoot cause analysis of CVE-2026-93897 in GeoDirectory, where the Post Badge renderer decoded an entity-encoded text field after inserting it into badge HTML, turning a Subscriber's stored value into l...
CryptoCat
@cryptocat.me

On a wpForo forum with guest editing enabled, an attacker could take over someone else's guest post just by knowing their email. The ownership check trusted an unsigned WordPress comment cookie 🍪 cryptocat.me/blog/researc...

cryptocat.mewpForo Forum Guest Post Takeover via a Forged Ownership Cookie | CVE-2026-91092 | CryptoCat's BlogHow wpForo let anyone who knew a guest author's email rewrite that author's forum post by forging the WordPress comment author cookie, and what the 3.1.6 fix changed.
CryptoCat
@cryptocat.me

To read private chat rooms in Better Messages, just tell it you're the AI bot. Identity was an IP-prefix check, and the IP came from a request header 🤖 cryptocat.me/blog/researc...

cryptocat.meBetter Messages Unauthenticated Information Exposure via a Spoofed AI Bot Identity | CVE-2026-89093 | CryptoCat's BlogRoot cause analysis of CVE-2026-89093 in Better Messages, where an unauthenticated guest sets a request header to impersonate the plugin's AI chat bot, passing every chat room permission check to read...
CryptoCat
@cryptocat.me

Found an SQL injection in WCFM Marketplace, the WooCommerce multivendor plugin. A guest's checkout coordinates flow straight into a store-distance query, enough to read WordPress password hashes. CVE-2026-18442, fixed in 3.8.2, $134 bounty. cryptocat.me/blog/researc...

cryptocat.meWCFM Marketplace Unauthenticated SQL Injection via Checkout Distance Shipping | CVE-2026-18442 | CryptoCat's BlogRoot cause analysis of CVE-2026-18442 in WCFM Marketplace, where unauthenticated checkout delivery coordinates reached a store-distance SQL query and allowed a blind read of WordPress password hashes.
CryptoCat
@cryptocat.me

An unauth stored XSS I found was disclosed yesterday. TLDR: X-Forwarded-For header gets logged as your IP without ever being checked, then runs in the admin's browser when they open the error log 😈 cryptocat.me/blog/researc...

cryptocat.meWP Photo Album Plus Unauthenticated Stored XSS via Error Log Injection | CVE-2026-18579 | CryptoCat's BlogRoot cause analysis of CVE-2026-18579 in WP Photo Album Plus, where an unauthenticated X-Forwarded-For header became the acting user in the error log and ran as script when an administrator opened the...
CryptoCat
@cryptocat.me

Last year, I tried to analyse a new CVE in ASUS routers. In the process, I found a patch bypass for another CVE. It's quite a long [tutorial-y] writeup from what feels like a distant time away, before I ever touched claude/codex etc 😅 cryptocat.me/blog/researc...

cryptocat.meASUS Router bwdpi SQL Injection Patch Bypass | CVE-2026-11851 | CryptoCat's BlogRoot cause analysis of CVE-2026-11851 in ASUS router firmware, where existing input validation failed to prevent an authenticated bwdpi SQL injection.
CryptoCat
@cryptocat.me

Another Essential Addons bug.. with a much smaller bounty! 😁 A Contributor could poison the site-wide Reading Progress bar with JavaScript. Once their post was published, moving over the bar on an unrelated page ran the payload in the visitor's session. cryptocat.me/blog/researc...

cryptocat.meEssential Addons for Elementor Global Reading Progress Stored XSS | CVE-2026-15156 | CryptoCat's BlogRoot cause analysis of CVE-2026-15156 in Essential Addons for Elementor Lite, where a Contributor-controlled Reading Progress colour is stored globally and rendered without escaping, causing stored XS...
CryptoCat
@cryptocat.me

It might not be RCE in core, but I was awarded an $859 bounty for this bug 🙏 When entering a victim email into a password reset field, you can inject a newline and [silenty] BCC the attacker on the password reset email 😼 cryptocat.me/blog/researc...

cryptocat.meEssential Addons for Elementor Email Header Injection to Admin Account Takeover | CVE-2026-15155 | CryptoCat's BlogRoot cause analysis of CVE-2026-15155 in Essential Addons for Elementor Lite, where a Contributor-controlled Login/Register widget setting injects a Bcc header into the administrator password reset em...