## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An authenticated attacker with Subscriber-level access can upload arbitrary file types to the server by sending a REST API request to the `rest_simpleFileUpload` endpoint without proper file type validation. ```http POST /w...
Read article →## The Exploit An authenticated attacker with author-level permissions uploads a file with a double extension like `data.php.wxr.xml` to WordPress, and the plugin's importer accepts it as a valid WXR file while the web server executes it a...
Read article →## The Exploit An authenticated user with Subscriber role (the lowest privilege tier in WordPress) can obtain and use an OAuth token to invoke admin-level MCP tools without holding administrator capabilities. ```http POST /wp-json/mwai/v1...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary PHP objects into the Better Search Replace plugin by supplying a malicious serialized payload to the deserialization sink. No authentication or CSRF token is required. ```htt...
Read article →## The Exploit An authenticated user with subscriber-level permissions can invoke the `authenticate` AJAX action in Tutor LMS Pro without admin-role verification, allowing account takeover of any administrator on the WordPress install. ``...
Read article →## The Exploit An authenticated WordPress user with Subscriber-level access can invoke W3 Total Cache admin functionality, generate a valid plugin nonce, and trigger arbitrary admin actions without holding the `manage_options` capability. ...
Read article →## The Exploit An unauthenticated attacker can craft a form submission that embeds an arbitrary file path (e.g., `/var/www/html/wp-config.php`) in the file metadata. When a site administrator or automated process deletes the form entry, Fo...
Read article →## The Exploit An unauthenticated attacker can delete arbitrary directories on the server by submitting a specially crafted POST request that traverses out of the intended upload directory. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 H...
Read article →## The Exploit An authenticated attacker with subscriber-level privileges can escalate to administrator by sending a single AJAX request to the form_save_action handler, which accepts form configuration data without capability checks. ```...
Read article →