## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can install and activate arbitrary plugins by sending a single REST API request with no authentication token or capability check. ```http POST /wp-json/gutenkit/v1/install-and-activate-plugin HTT...
Read article →## The Exploit An unauthenticated attacker with knowledge of a target WordPress username can bypass authentication and log in as that user without ever knowing their password. ```http POST /wp-json/instawp-connect/v1/temporary-login HTTP/...
Read article →## The Exploit An unauthenticated attacker can call the `storeTheme()` function via the plugin's AJAX endpoint and modify WordPress site theme colors without any authorization check. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: ta...
Read article →## The Exploit An unauthenticated attacker with access to a published Bit Form containing an advanced file upload element can bypass file type validation and upload arbitrary files (including PHP) to the server by omitting or spoofing the ...
Read article →## The Exploit An unauthenticated attacker with no valid user account can delete arbitrary files on the WordPress installation by crafting a POST request with a malicious `form_id` parameter containing path traversal sequences. ```http PO...
Read article →## The Exploit An unauthenticated attacker can manipulate WordPress admin menu ordering by sending a single AJAX request to the `rm_user_exists` action, injecting an empty or whitespace-padded slug into the `admin_order` parameter. This ca...
Read article →## The Exploit An unauthenticated attacker can reset the email and password of any WordPress user account by sending a direct request to the customer profile update endpoint without authentication. ```http POST /wp-admin/admin-ajax.php HT...
Read article →## The Exploit An unauthenticated attacker can demote any WordPress administrator to the vendor role, create new vendor accounts, or reset passwords of existing vendors by sending POST requests directly to the REST API without authenticati...
Read article →## The Exploit An unauthenticated attacker with the ability to intercept or influence the social login callback can log in as any existing WordPress user — including administrator accounts — by submitting a token from any social provider t...
Read article →