## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can inject arbitrary SQL into LearnPress course queries via the `term_id` parameter in the course filter API by passing a non-integer value that bypasses `esc_sql()` validation. ```http GET /wp-j...
Read article →## The Exploit An unauthenticated attacker crafts a serialized PHP object and stores it in a Contact Form 7 entry via the plugin's form submission mechanism, then retrieves it through the `get_lead_detail` function to trigger object instan...
Read article →## The Exploit An unauthenticated attacker with knowledge of a target WordPress user's email address can hijack that account via social login, even if the user has never previously linked a social account to their WordPress profile. ```ht...
Read article →## The Exploit An unauthenticated attacker can create a WordPress administrator account by sending a single HTTP request to the user registration endpoint, supplying an arbitrary `role` parameter in the request body. ```http POST /wp-json...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary SQL into the member directory sorting query by manipulating the `sorting` parameter. No authentication or admin access required. ```http GET /wp-admin/admin-ajax.php?action=u...
Read article →## The Exploit An unauthenticated attacker with network access to a WordPress site running Backup Migration ≤1.3.9 can delete arbitrary files by sending a single POST request to the backup restoration endpoint, weaponizing unsanitized HTTP...
Read article →## The Exploit An unauthenticated attacker can upload arbitrary files by targeting any form field that is *registered* in the form configuration, regardless of whether that field's type is set to `'file'`. No authentication, no CSRF token,...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary PHP callbacks into Kali Forms' placeholder processing pipeline by submitting crafted POST field names that override legitimate internal placeholder handlers. ```http POST /wp...
Read article →## The Exploit An unauthenticated attacker with the "Host Files Locally - Gravatars" feature enabled can upload arbitrary files to the server by injecting a malicious `srcset` or `src` URL into a Gravatar HTML tag during WordPress cron exe...
Read article →