## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An authenticated WordPress user with Subscriber role or above can install and activate arbitrary plugins without administrative permission. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.wordpress.local Content...
Read article →## The Exploit An authenticated attacker with Subscriber-level access or higher can inject arbitrary SQL through the `options[list_id]` parameter in Icegram Express forms. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local ...
Read article →## The Exploit An authenticated subscriber or customer-level user can modify the email address of any WordPress user account, including administrators, by sending a direct object reference bypass to the WCFM customer management endpoint. ...
Read article →## The Exploit **A contributor-level WordPress user can include arbitrary PHP files from the server filesystem by sending a crafted request to the ElementsKit plugin's Onepage Scroll module.** ```http POST /wp-admin/admin-ajax.php HTTP/1....
Read article →## The Exploit An authenticated WordPress user with subscriber-level access and above can execute arbitrary SQL queries and trigger PHP object injection by sending a specially crafted AJAX request to the Email Subscribers by Icegram Expres...
Read article →## The Exploit An unauthenticated attacker with the ability to submit a Contact Form 7 form (when Flamingo is active) can craft a malicious file path containing traversal sequences, then trigger deletion of arbitrary files on the server by...
Read article →## The Exploit An attacker with Subscriber-level access or higher can upload arbitrary files by sending a direct API request to the vulnerable `gspb_make_proxy_api_request()` function without any file type validation. ```http POST /wp-adm...
Read article →## The Exploit An authenticated user with Subscriber role or higher can inject arbitrary PHP code into the plugin's `customFunction.php` file and trigger remote code execution. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.l...
Read article →## The Exploit An authenticated WordPress user with subscriber-level access (or above) can escalate their own privileges to administrator by calling the vulnerable AJAX endpoint without administrator capabilities being checked. ```http PO...
Read article →