# 100 WordPress Security Alerts A numbered index of 100 WordPress security alerts with links to the individual guides. 2026-10-01 :: Switchboard Tech Services ![100 WordPress Security Alerts](https://switchboardtechservices.com/static/images/defaults/guides.webp) WordPress site owners need to know what an attack can look like before a warning turns into an incident. This index links to 100 security guides, beginning with documented core vulnerabilities and continuing through exploit patterns to check in plugins, themes, integrations, and hosting. ## 100 WordPress security alerts 1. [Core facilitated SQL injection (CVE-2026-60137)](https://switchboardtechservices.com/guides/wordpress-alert-core-facilitated-sql-injection/) 2. [REST batch-route confusion leading to code execution (CVE-2026-63030)](https://switchboardtechservices.com/guides/wordpress-alert-rest-batch-route-confusion-leading-to-code-execution/) 3. [Page-template local file inclusion (CVE-2026-87902)](https://switchboardtechservices.com/guides/wordpress-alert-page-template-local-file-inclusion/) 4. [Unauthenticated REST endpoint access](https://switchboardtechservices.com/guides/wordpress-alert-unauthenticated-rest-endpoint-access/) 5. [REST API object authorization bypass](https://switchboardtechservices.com/guides/wordpress-alert-rest-api-object-authorization-bypass/) 6. [REST API privilege escalation](https://switchboardtechservices.com/guides/wordpress-alert-rest-api-privilege-escalation/) 7. [REST API mass assignment](https://switchboardtechservices.com/guides/wordpress-alert-rest-api-mass-assignment/) 8. [Exposed custom REST routes](https://switchboardtechservices.com/guides/wordpress-alert-exposed-custom-rest-routes/) 9. [Unprotected admin-ajax.php actions](https://switchboardtechservices.com/guides/wordpress-alert-unprotected-admin-ajax-php-actions/) 10. [Unprotected admin-post.php actions](https://switchboardtechservices.com/guides/wordpress-alert-unprotected-admin-post-php-actions/) 11. [Administrator credential stuffing](https://switchboardtechservices.com/guides/wordpress-alert-administrator-credential-stuffing/) 12. [Password spraying against WordPress logins](https://switchboardtechservices.com/guides/wordpress-alert-password-spraying-against-wordpress-logins/) 13. [XML-RPC login abuse](https://switchboardtechservices.com/guides/wordpress-alert-xml-rpc-login-abuse/) 14. [Weak password-reset tokens](https://switchboardtechservices.com/guides/wordpress-alert-weak-password-reset-tokens/) 15. [Password-reset link disclosure](https://switchboardtechservices.com/guides/wordpress-alert-password-reset-link-disclosure/) 16. [Account enumeration through login responses](https://switchboardtechservices.com/guides/wordpress-alert-account-enumeration-through-login-responses/) 17. [Two-factor authentication bypass in plugins](https://switchboardtechservices.com/guides/wordpress-alert-two-factor-authentication-bypass-in-plugins/) 18. [Session fixation](https://switchboardtechservices.com/guides/wordpress-alert-session-fixation/) 19. [Stolen administrator session cookies](https://switchboardtechservices.com/guides/wordpress-alert-stolen-administrator-session-cookies/) 20. [Application-password exposure](https://switchboardtechservices.com/guides/wordpress-alert-application-password-exposure/) 21. [Subscriber-to-administrator privilege escalation](https://switchboardtechservices.com/guides/wordpress-alert-subscriber-to-administrator-privilege-escalation/) 22. [Contributor-to-editor privilege escalation](https://switchboardtechservices.com/guides/wordpress-alert-contributor-to-editor-privilege-escalation/) 23. [Unauthorized user creation](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-user-creation/) 24. [Unauthorized role changes](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-role-changes/) 25. [Insecure direct object references in plugins](https://switchboardtechservices.com/guides/wordpress-alert-insecure-direct-object-references-in-plugins/) 26. [Private post access bypass](https://switchboardtechservices.com/guides/wordpress-alert-private-post-access-bypass/) 27. [Draft content disclosure](https://switchboardtechservices.com/guides/wordpress-alert-draft-content-disclosure/) 28. [Unauthorized settings changes](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-settings-changes/) 29. [Unauthorized plugin activation](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-plugin-activation/) 30. [Unauthorized theme installation](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-theme-installation/) 31. [Stored cross-site scripting in comments](https://switchboardtechservices.com/guides/wordpress-alert-stored-cross-site-scripting-in-comments/) 32. [Stored cross-site scripting in profiles](https://switchboardtechservices.com/guides/wordpress-alert-stored-cross-site-scripting-in-profiles/) 33. [Stored cross-site scripting in shortcodes](https://switchboardtechservices.com/guides/wordpress-alert-stored-cross-site-scripting-in-shortcodes/) 34. [Stored cross-site scripting in block attributes](https://switchboardtechservices.com/guides/wordpress-alert-stored-cross-site-scripting-in-block-attributes/) 35. [Reflected cross-site scripting in search](https://switchboardtechservices.com/guides/wordpress-alert-reflected-cross-site-scripting-in-search/) 36. [DOM-based cross-site scripting in page builders](https://switchboardtechservices.com/guides/wordpress-alert-dom-based-cross-site-scripting-in-page-builders/) 37. [Cross-site request forgery against settings](https://switchboardtechservices.com/guides/wordpress-alert-cross-site-request-forgery-against-settings/) 38. [Cross-site request forgery against user management](https://switchboardtechservices.com/guides/wordpress-alert-cross-site-request-forgery-against-user-management/) 39. [Malicious redirects through open-redirect flaws](https://switchboardtechservices.com/guides/wordpress-alert-malicious-redirects-through-open-redirect-flaws/) 40. [Clickjacking of administrative actions](https://switchboardtechservices.com/guides/wordpress-alert-clickjacking-of-administrative-actions/) 41. [SQL injection in search filters](https://switchboardtechservices.com/guides/wordpress-alert-sql-injection-in-search-filters/) 42. [SQL injection in sorting parameters](https://switchboardtechservices.com/guides/wordpress-alert-sql-injection-in-sorting-parameters/) 43. [SQL injection in reporting dashboards](https://switchboardtechservices.com/guides/wordpress-alert-sql-injection-in-reporting-dashboards/) 44. [SQL injection in booking plugins](https://switchboardtechservices.com/guides/wordpress-alert-sql-injection-in-booking-plugins/) 45. [SQL injection in form plugins](https://switchboardtechservices.com/guides/wordpress-alert-sql-injection-in-form-plugins/) 46. [Command injection in backup tools](https://switchboardtechservices.com/guides/wordpress-alert-command-injection-in-backup-tools/) 47. [Server-side template injection](https://switchboardtechservices.com/guides/wordpress-alert-server-side-template-injection/) 48. [PHP object injection through unsafe deserialization](https://switchboardtechservices.com/guides/wordpress-alert-php-object-injection-through-unsafe-deserialization/) 49. [Email-header injection in contact forms](https://switchboardtechservices.com/guides/wordpress-alert-email-header-injection-in-contact-forms/) 50. [Spreadsheet formula injection in exported CSV files](https://switchboardtechservices.com/guides/wordpress-alert-spreadsheet-formula-injection-in-exported-csv-files/) 51. [Unauthenticated arbitrary file upload](https://switchboardtechservices.com/guides/wordpress-alert-unauthenticated-arbitrary-file-upload/) 52. [Executable files disguised as images](https://switchboardtechservices.com/guides/wordpress-alert-executable-files-disguised-as-images/) 53. [Archive extraction path traversal](https://switchboardtechservices.com/guides/wordpress-alert-archive-extraction-path-traversal/) 54. [Local file inclusion in themes](https://switchboardtechservices.com/guides/wordpress-alert-local-file-inclusion-in-themes/) 55. [Remote file inclusion in plugins](https://switchboardtechservices.com/guides/wordpress-alert-remote-file-inclusion-in-plugins/) 56. [Arbitrary file read through download endpoints](https://switchboardtechservices.com/guides/wordpress-alert-arbitrary-file-read-through-download-endpoints/) 57. [Arbitrary file deletion](https://switchboardtechservices.com/guides/wordpress-alert-arbitrary-file-deletion/) 58. [Writable theme or plugin editor abuse](https://switchboardtechservices.com/guides/wordpress-alert-writable-theme-or-plugin-editor-abuse/) 59. [Publicly accessible database backups](https://switchboardtechservices.com/guides/wordpress-alert-publicly-accessible-database-backups/) 60. [Exposed migration archives](https://switchboardtechservices.com/guides/wordpress-alert-exposed-migration-archives/) 61. [Checkout-field upload vulnerabilities](https://switchboardtechservices.com/guides/wordpress-alert-checkout-field-upload-vulnerabilities/) 62. [Order record access bypass](https://switchboardtechservices.com/guides/wordpress-alert-order-record-access-bypass/) 63. [Customer data disclosure](https://switchboardtechservices.com/guides/wordpress-alert-customer-data-disclosure/) 64. [Coupon creation without authorization](https://switchboardtechservices.com/guides/wordpress-alert-coupon-creation-without-authorization/) 65. [Unauthorized price changes](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-price-changes/) 66. [Cart total manipulation](https://switchboardtechservices.com/guides/wordpress-alert-cart-total-manipulation/) 67. [Payment status spoofing](https://switchboardtechservices.com/guides/wordpress-alert-payment-status-spoofing/) 68. [Webhook signature validation failures](https://switchboardtechservices.com/guides/wordpress-alert-webhook-signature-validation-failures/) 69. [Subscription ownership bypass](https://switchboardtechservices.com/guides/wordpress-alert-subscription-ownership-bypass/) 70. [Gift-card balance manipulation](https://switchboardtechservices.com/guides/wordpress-alert-gift-card-balance-manipulation/) 71. [Contact-form attachment disclosure](https://switchboardtechservices.com/guides/wordpress-alert-contact-form-attachment-disclosure/) 72. [Form submission data leakage](https://switchboardtechservices.com/guides/wordpress-alert-form-submission-data-leakage/) 73. [Booking token disclosure](https://switchboardtechservices.com/guides/wordpress-alert-booking-token-disclosure/) 74. [Booking deletion without authorization](https://switchboardtechservices.com/guides/wordpress-alert-booking-deletion-without-authorization/) 75. [Membership access bypass](https://switchboardtechservices.com/guides/wordpress-alert-membership-access-bypass/) 76. [Paid-download authorization bypass](https://switchboardtechservices.com/guides/wordpress-alert-paid-download-authorization-bypass/) 77. [LMS course access bypass](https://switchboardtechservices.com/guides/wordpress-alert-lms-course-access-bypass/) 78. [Event-registration data exposure](https://switchboardtechservices.com/guides/wordpress-alert-event-registration-data-exposure/) 79. [Unauthorized post publication](https://switchboardtechservices.com/guides/wordpress-alert-unauthorized-post-publication/) 80. [Media-library access bypass](https://switchboardtechservices.com/guides/wordpress-alert-media-library-access-bypass/) 81. [Server-side request forgery in URL preview tools](https://switchboardtechservices.com/guides/wordpress-alert-server-side-request-forgery-in-url-preview-tools/) 82. [Server-side request forgery in import tools](https://switchboardtechservices.com/guides/wordpress-alert-server-side-request-forgery-in-import-tools/) 83. [Webhook endpoint authorization bypass](https://switchboardtechservices.com/guides/wordpress-alert-webhook-endpoint-authorization-bypass/) 84. [OAuth account-linking flaws](https://switchboardtechservices.com/guides/wordpress-alert-oauth-account-linking-flaws/) 85. [Exposed API keys in plugin settings](https://switchboardtechservices.com/guides/wordpress-alert-exposed-api-keys-in-plugin-settings/) 86. [Backup restoration without authorization](https://switchboardtechservices.com/guides/wordpress-alert-backup-restoration-without-authorization/) 87. [Staging-to-production credential reuse](https://switchboardtechservices.com/guides/wordpress-alert-staging-to-production-credential-reuse/) 88. [Vulnerable abandoned plugins](https://switchboardtechservices.com/guides/wordpress-alert-vulnerable-abandoned-plugins/) 89. [Compromised third-party plugin updates](https://switchboardtechservices.com/guides/wordpress-alert-compromised-third-party-plugin-updates/) 90. [Malicious nulled themes or plugins](https://switchboardtechservices.com/guides/wordpress-alert-malicious-nulled-themes-or-plugins/) 91. [Exposed wp-config.php backups](https://switchboardtechservices.com/guides/wordpress-alert-exposed-wp-config-php-backups/) 92. [Public .git directories](https://switchboardtechservices.com/guides/wordpress-alert-public-git-directories/) 93. [Public debug logs containing secrets](https://switchboardtechservices.com/guides/wordpress-alert-public-debug-logs-containing-secrets/) 94. [Database administration panels left exposed](https://switchboardtechservices.com/guides/wordpress-alert-database-administration-panels-left-exposed/) 95. [PHP execution inside upload directories](https://switchboardtechservices.com/guides/wordpress-alert-php-execution-inside-upload-directories/) 96. [Insecure file permissions](https://switchboardtechservices.com/guides/wordpress-alert-insecure-file-permissions/) 97. [Outdated PHP runtime vulnerabilities](https://switchboardtechservices.com/guides/wordpress-alert-outdated-php-runtime-vulnerabilities/) 98. [Cross-site contamination on shared hosting](https://switchboardtechservices.com/guides/wordpress-alert-cross-site-contamination-on-shared-hosting/) 99. [Cache poisoning that exposes private pages](https://switchboardtechservices.com/guides/wordpress-alert-cache-poisoning-that-exposes-private-pages/) 100. [Multisite tenant isolation bypass](https://switchboardtechservices.com/guides/wordpress-alert-multisite-tenant-isolation-bypass/) The first three entries describe documented core vulnerabilities; the remaining entries describe classes of risk, not proof that every site is affected. Follow each guide's documentation and verify your installed versions before deciding what action is needed. - Categories: [WordPress](https://switchboardtechservices.com/guides/categories/wordpress/) - Tags: [#security](https://switchboardtechservices.com/guides/tags/security/), [#WordPress Security](https://switchboardtechservices.com/guides/tags/wordpress-security/), [#WordPress](https://switchboardtechservices.com/guides/tags/wordpress/), [#Vulnerabilities](https://switchboardtechservices.com/guides/tags/vulnerabilities/), [#Site Maintenance](https://switchboardtechservices.com/guides/tags/site-maintenance/) [Guides RSS](https://switchboardtechservices.com/feeds/guides.xml "Subscribe using an RSS reader") --- Canonical URL: https://switchboardtechservices.com/guides/100-wordpress-security-alerts/ Language: en-us Content type: guide Author: Switchboard Tech Services Published: 2026-10-01T17:22:27+00:00