Guides

One or a few common passwords are tried across many accounts. A weak account may be taken over without a large attack volume per user.

Reset URLs appear in logs, analytics, or unintended messages. Anyone with a valid link may take over the account before it expires.

A file link works without checking purchase or membership rights. Paid files may be shared publicly.

An affected version and the advisory's theme and server preconditions allow an unexpected local PHP file to be included. Under those conditions, unauthenticated code execution may follow.

The host runs a PHP version without the fixes available in supported releases. A server-side flaw may remain exploitable despite updated WordPress code.

A customer can view or alter an order that is not theirs. Names, addresses, and purchase details may leak.

A social-login integration links a local account to the wrong external identity. An attacker may gain access to another user's WordPress account.

A subsite user reaches network-level settings or another site's content. One tenant may affect the wider WordPress network.

A paid-content route checks login state but not membership entitlement. Nonmembers may read or download restricted material.

A user can read or change attachments outside their permitted scope. Private files or other authors' media may be affected.

A site link forwards visitors to an attacker-chosen destination. The trusted domain can be used in phishing links.

A pirated package contains hidden code or a modified updater. It may create a backdoor or steal data.

A theme selects a PHP template from untrusted input. A readable file outside the expected theme path may be included.

A course route exposes lessons to a user who has not enrolled. Paid or restricted learning material may leak.

Site files or directories are writable by more users or processes than needed. An attacker with limited access may alter code or content.

Changing a record ID exposes another user's booking, form entry, or file. Private information crosses account boundaries.

A gift-card extension trusts balance changes from an unauthorized request. Store credit may be created or spent improperly.

A form endpoint exposes saved entries beyond the intended staff roles. Contact details or confidential messages may leak.

A copied configuration file is served as plain text from the web root. Database credentials and security keys may leak.

A migration package remains publicly downloadable after a move. It may contain database data and configuration secrets.