## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit A Subscriber-level WordPress user (the lowest authenticated role) can read arbitrary files from the server by sending an unauthenticated AJAX request to the plugin's file-read handlers. ```http POST /wp-admin/admin-ajax.php...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary WordPress shortcodes into the `bp-message` cookie, which are then executed server-side when the template message is rendered. ```http GET / HTTP/1.1 Host: target-wordpress.lo...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into a WordPress page by crafting a malicious HTTP request with XSS payload in the `device` header parameter. When an admin or user visits the affected page, the in...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary HTML and JavaScript into WPForms Pro form fields. When a site visitor later views a page containing the form or accesses admin notifications, the malicious script executes in ...
Read article →## The Exploit An authenticated Subscriber-level attacker can delete arbitrary files from the server by sending a specially crafted AJAX request that bypasses path validation in the file deletion routine. ```http POST /wp-admin/admin-ajax...
Read article →## The Exploit An authenticated WordPress user with Author-level access or above can upload a PHP file by naming it in a way that exploits insufficient filename validation in the Royal Addons for Elementor template upload handler. ```http...
Read article →## The Exploit An authenticated user with vendor-level access (the default role for customers in Dokan Pro) can escalate privileges to staff level and takeover administrator accounts by directly updating arbitrary user passwords without au...
Read article →## The Exploit An unauthenticated attacker with network access to the WordPress REST API can invoke the `/wp-json/payu/v1/get-shipping-cost` endpoint to bypass authentication entirely. The endpoint accepts arbitrary email and transaction I...
Read article →## The Exploit An unauthenticated attacker can upload arbitrary files to the WordPress installation by sending a specially crafted request to the `/wp-json/storychief/webhook` REST endpoint, which accepts a remote URL parameter that is fet...
Read article →