## The Exploit An unauthenticated attacker can perform SQL injection via the `author__not_in` parameter in any REST API endpoint that passes user input to `WP_Query`. The following curl request demonstrates the injection against the default `/wp/v2/posts` endpoint. ```bash curl...
## The Exploit An authenticated subscriber-level user can change the email address—and by extension, reset the password—of any administrator account. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target-wordpress.local Content-Type...
Read article →## The Exploit **An authenticated subscriber can delete arbitrary files on the server by embedding a path traversal sequence in a forum post, then deleting that post.** ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Con...
Read article →## The Exploit An authenticated student-level user can escalate to administrator by sending a single REST API PATCH request to their own user endpoint, supplying a `roles` array that includes `administrator`. ```http PATCH /wp-json/llms/v...
Read article →## The Exploit **An authenticated contributor can traverse the filesystem and execute arbitrary PHP by uploading an SVG file and including it via a path traversal payload in the `get_svg()` function.** ```http POST /wp-admin/admin-ajax.ph...
Read article →## The Exploit An attacker with Author role or higher can update arbitrary WordPress options through the REST API without capability checks, allowing modification of plugin settings, security keys, or other critical configuration. ```http...
Read article →## The Exploit An authenticated editor—either pre-existing or newly registered via a public registration form—can escalate their own account to administrator by manipulating form configuration POST data and then submitting a crafted role a...
Read article →## The Exploit An authenticated attacker with contributor-level access to WordPress can include and execute arbitrary PHP files on the server by manipulating the `ekit_testimonial_style` parameter in a request that triggers the vulnerable ...
Read article →## The Exploit An unauthenticated attacker can inject a serialized PHP object into the plugin's search-replace functionality by crafting a malicious staging site creation request. When the administrator triggers a search-replace operation ...
Read article →## The Exploit An authenticated WordPress user with Subscriber-level access (or higher) can modify arbitrary site options by sending a POST request to any affected plugin's settings import handler without providing a valid nonce. ```http ...
Read article →