Guides

A theme-management endpoint accepts a user without installation rights. Attacker-controlled theme code could be installed if other safeguards fail.

A low-privilege request updates site options or plugin configuration. Security controls, destinations, or site behavior may be changed.

A settings or profile request changes a user's capabilities unexpectedly. An attacker may gain more access or remove a defender's access.

A product endpoint accepts edits from a user without catalog rights. Products may be sold at unintended prices.

A contributor-level action publishes content despite editorial restrictions. Unreviewed or malicious material can go live.

A nonadministrator can activate installed code through a plugin or API flaw. New functionality may run with broad site privileges.

A custom REST route returns private records or performs changes for a signed-out visitor. Data may leak or site state may change without an account.

A public form accepts a file type or location it should reject. The uploaded file may expose users or, in some configurations, execute server code.

A third-party login route accepts a password without enforcing the site's second factor. A stolen password may become sufficient for account access.

A customer can change another customer's subscription identifier in a request. Billing or subscription settings may be altered across accounts.

A subscriber can change their role or call a privileged plugin action. A basic account may become a site administrator.

Untrusted shortcode attributes become executable HTML or JavaScript. A page view can run attacker-controlled script.

A user profile field executes code in another user's browser. Viewing the profile may trigger unwanted actions or data theft.

A comment carries script-capable content that runs when staff view it. The script can act in the staff member's browser and may expose session data.

A custom block saves a value that later executes in the editor or public page. Editors or visitors can be affected each time the block renders.

An active admin session is reused from another browser or location. The attacker can act as the administrator until the session is revoked.

A staging site's exposed password or token also works on production. Compromise of the test site may lead to production access.

A user-controlled sort field is inserted into a database query. The query structure may be altered if the field is not allowlisted.

A plugin builds a database query from a search filter without safe parameterization. Attackers may read or change data under the vulnerable query's conditions.

Report filters become part of an unsafe SQL query. Sensitive records may be exposed or reports altered.