## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An authenticated WordPress user with subscriber-level access (or above) can delete arbitrary files on the server by sending a specially crafted AJAX request that bypasses path traversal validation. ```http POST /wp-admin/ad...
Read article →## The Exploit **An authenticated Subscriber can refund payments and cancel subscriptions by sending an AJAX request with a valid nonce, because the handler performs no capability check before processing the action.** ```http POST /wp-adm...
Read article →## The Exploit An unauthenticated attacker with control over a social identity provider (or ability to register an account on one) can log in as any existing WordPress user, including administrators, by submitting a social login callback w...
Read article →## The Exploit An unauthenticated attacker can bypass file type restrictions by uploading a `.svgz` (compressed SVG) file through any Royal Elementor Addons form that accepts file uploads, provided the form does not explicitly exclude `.sv...
Read article →## The Exploit Unauthenticated attacker sends a REST API request to the Popup builder plugin with a malicious `campaign_id` parameter containing SQL syntax. ```http GET /wp-json/popupbuilder/v1/analytics/device-stats?start_date=2025-01-01...
Read article →## The Exploit Unauthenticated attacker. An AJAX POST to the `add_listing_action` endpoint with a crafted `$image` parameter containing path traversal sequences will move an arbitrary file on the server to a web-accessible location, or ove...
Read article →## The Exploit An unauthenticated attacker on a WordPress Multisite installation can read and delete arbitrary files by calling the plugin's backup endpoints without proper authorization checks. ```http GET /?wp_db_backup=1&fragment=1 HTT...
Read article →## The Exploit An unauthenticated attacker can move arbitrary files on the server if the form contains a file upload field and "Saving inquiry data in database" is enabled. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local...
Read article →## The Exploit An unauthenticated attacker with no special role needs only to craft a URL. When a victim or the attacker themselves visits the malicious link, WordPress logs in the attacker as the first administrator who previously used Fa...
Read article →