## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into WordPress admin pages by crafting a malicious URL that WP Statistics processes and reflects without proper escaping. ```http GET /wp-admin/admin.php?page=wps_...
Read article →## The Exploit An unauthenticated attacker must be able to add or modify a review on a Google Place that is connected to the vulnerable WordPress site. Once the malicious review is stored in Google's system, the plugin will automatically i...
Read article →## The Exploit **Prerequisite:** Authenticated WordPress user with subscriber access or above on a wpForo-enabled site running version 3.0.2 or earlier. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Content-Type: appli...
Read article →## The Exploit An unauthenticated attacker can modify or delete arbitrary user and term metadata by sending a REST API request without any authentication header. ```http POST /wp-json/rank-math/v1/updateMeta HTTP/1.1 Host: target.wordpres...
Read article →## The Exploit An unauthenticated attacker with network access to an exposed elFinder instance can delete arbitrary files from the server by crafting a directory traversal request that bypasses the weak path sanitization. ```http POST /wp...
Read article →## The Exploit An authenticated attacker with Subscriber-level access or above can inject a malicious serialized PHP object via the `parseUserProperties` function in FormValidationService.php, exploiting the insecure `unserialize()` call o...
Read article →## The Exploit An unauthenticated attacker can forge a request that redirects a logged-in WordPress admin to a malicious external site while injecting a weaponized token parameter. The attacker needs no prior access — only the ability to t...
Read article →## The Exploit **An unauthenticated attacker must trick a WordPress administrator into clicking a malicious link or visiting a crafted webpage while logged in to the WordPress dashboard.** The attacker sends a forged AJAX request to the Ro...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into form submission data by crafting a POST request with a malicious filename in the `files` parameter. When a site administrator or user views the stored form sub...
Read article →