Guides

A form lookup or submission filter is concatenated into SQL. Saved entries may be read or modified.

A booking search or calendar parameter reaches an unsafe query. Reservation and customer data may be exposed.

A form or report export begins a cell with formula syntax. Opening the CSV in spreadsheet software may execute a formula.

A session identifier survives the transition from signed-out to signed-in state. A person who knows the identifier may inherit the authenticated session.

A theme or builder evaluates user-controlled text as a template. Template capabilities may disclose data or run unintended operations.

A preview tool fetches an attacker-supplied URL from the server. The server may reach internal services or metadata endpoints.

An importer downloads content from an unrestricted address. Internal services may be reached through the WordPress host.

An affected core version still exposes the vulnerable REST batch-route behavior. The documented route-confusion and SQL injection chain can lead to remote code execution.

A low-privilege account can invoke a REST action reserved for an editor or administrator. The account may gain publishing or administrative powers.

A logged-in user can retrieve or edit another user's resource by changing its identifier. Private records may be read or modified across accounts.

A REST update accepts fields the current user should not control, such as role or ownership. An ordinary edit can become a privilege or content-ownership change.

A plugin includes code from a URL or untrusted location. Attacker-controlled code may run if the runtime and plugin permit it.

A crafted search URL echoes unsafe text into the page. A visitor following the link may execute attacker-controlled script.

A database dump sits under a web-accessible directory. Visitors may download user and site data.

A deployed repository directory is web-accessible. Source code and sometimes secrets may be retrievable.

A debug or error log can be downloaded by visitors. Stack traces, tokens, or personal data may be exposed.

A route or plugin reveals a post marked private to an unauthorized visitor. Restricted content becomes publicly accessible.

A plugin unserializes untrusted input into PHP objects. Available object behaviors may be abused, sometimes with severe consequences.

The web server executes scripts stored in uploads. An upload flaw can become server code execution.

A payment integration accepts an unverified completion signal. An unpaid order may appear paid or be fulfilled.