## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can read arbitrary files from the server by submitting a form with a file-upload field, injecting path-traversal sequences into the `old_files` POST parameter, and observing the file contents in t...
Read article →## The Exploit An unauthenticated attacker with access to a form containing a file upload field can move arbitrary files on the server by manipulating the filename parameter during form submission. ```http POST /wp-admin/admin-ajax.php HT...
Read article →## The Exploit An authenticated Contributor-level user with access to the `[code_snippet]` shortcode can inject arbitrary PHP via the shortcode attributes parameter when "Enable file-based execution" is active and at least one snippet is e...
Read article →## The Exploit An unauthenticated attacker submits a POST request to the WooCommerce order export endpoint with a malicious serialized PHP object in the order data field when the "Try to convert serialized values" option is enabled on the ...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary SQL into time-based blind queries by manipulating the `page_url` parameter passed to the Remediation module's database query handler. The plugin must have the Remediation modu...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary SQL via the `s` parameter in the LeadsAjaxController AJAX endpoints. The parameter is passed directly into database queries after being sanitized with `textfield()` instead of...
Read article →## The Exploit An unauthenticated attacker can extract arbitrary data from the WordPress database by injecting SQL time-delay payloads into the `active_status` parameter of any Events Manager query endpoint. ```http GET /wp-admin/admin-aj...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary SQL into the `field` or `field_where` parameters of the plugin's database query methods by appending SQL operators and subqueries. No authentication or CSRF token is required....
Read article →## The Exploit An unauthenticated attacker with network access to any WordPress site running W3 Total Cache ≤ 2.9.3 can leak the `W3TC_DYNAMIC_SECURITY` token by crafting a single HTTP request with a spoofed User-Agent header. Once the tok...
Read article →