Themes Vulnerabilities

QAEngine Theme - Privilege Escalation

Description

QAEngine vulnerability allows an attacker to have an administrator account on the target's website.

Proof of Concept

Affects Themes

qaengine
No known fix

References

URL
https://packetstormsecurity.com/files/#131648/
URL
https://web.archive.org/web/20150912144515/https://research.evex.pw/?vuln=10

Miscellaneous

Submitter
A. Samman
Submitter twitter
Evex_1337
Verified
No
WPVDB ID
061926d7-c44d-4468-80e5-8eec61224e2f

Timeline

Publicly Published
2015-04-06 (about 11 years ago)
Added
2015-04-07 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2025-11-10
Title
Hydra Booking < 1.1.28 - Unauthenticated Payment Bypass
Published
2020-05-06
Title
Elementor < 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS
Published
2024-05-21
Title
Element Pack Elementor Addons < 5.6.4 - Form Submission Admin Email Bypass
Published
2026-02-17
Title
Brevo < 3.3.1 - Unauthenticated Authorization Bypass via Type Juggling
Published
2017-07-25
Title
Stop User Enumeration <= 1.3.8 - REST API Bypass