The ZIP archives under vulnerable-plugin/ and dependencies/ are unmodified
third-party WordPress plugin packages retained for exact-version security
research and reproducibility.
Each vulnerable package has an adjacent SOURCE.txt recording its origin and
SHA-256 digest. Most packages originated from the official WordPress plugin
distribution service; the conceptual-PoC metadata records alternate recovery
sources where an older release had been removed upstream.
The five dependency copies are:
- Elementor 3.23.0, used by CVE-2024-1567. Origin:
https://downloads.wordpress.org/plugin/elementor.3.23.0.zip. - WooCommerce 9.2.3, used by CVE-2024-32511, CVE-2024-7257,
CVE-2025-47535, and CVE-2026-49065. Origin:
https://downloads.wordpress.org/plugin/woocommerce.9.2.3.zip.
Dependency archive verification:
| Archive | Size | SHA-256 |
|---|---|---|
elementor.3.23.0.zip |
12,093,293 bytes | 7a62d3f06dd07b538bddce15c2965531b5ad4d63fb50cf67ddd281af44bf5f51 |
woocommerce.9.2.3.zip |
21,492,151 bytes | 3d49f97ab85da08f0275143379a6a0b701dc6917327bba3535239087c3a7f5c5 |
Third-party packages retain their own copyright and licensing terms. Before publishing this repository, review the license files inside each archive and the applicable upstream distribution terms. The exploit code and evidence do not replace or alter those notices.