## https://sploitus.com/exploit?id=309CAD3F-48DF-5406-878E-0709CB1003E8
# CVE Reversing Lab
A personal training repo for practicing "N-day reversing" on WordPress plugins:
take a disclosed CVE with a public patch, diff the vulnerable and fixed
versions, work out the root cause, and produce a local-lab proof of concept and
a Nuclei detection template.
See [`CLAUDE.md`](CLAUDE.md) for the scope/rules and
[`.claude/skills/cve-reversing/SKILL.md`](.claude/skills/cve-reversing/SKILL.md)
for the mechanics.
## Usage
```
/cve
```
Reverses today's qualifying WordPress plugin CVEs from Patchstack.
```
/cve CVE-2026-12345
```
Reverses one specific CVE.
## Layout
- `cves/INDEX.md` — running index of every reversed finding
- `cves//-/` — one folder per finding: `report.md`,
`poc.md`, `nuclei.yaml`, `patch.diff`, `README.md`
- `scripts/fetch_plugin_versions.sh` — downloads two plugin versions from
wordpress.org and diffs them
## Scope
WordPress plugins only, CVSS >= 6, no admin-only bugs, PoCs are for local-lab
testing against your own WordPress installs — not mass exploitation. Nothing
in this repo is pushed to GitHub automatically; that's always a deliberate,
separate step.