Guides

A plugin registers a route that discloses internal data or actions more broadly than intended. Remote callers may reach functionality that was assumed to be private.

A plugin renders a secret in a public page, response, or log. Third parties may call connected services or APIs.

An upload accepts a file based only on its name or claimed content type. A script may be stored where it can be executed or served to visitors.

An event plugin lists attendee details to the wrong users. Names and contact information may be disclosed.

A contact form accepts newline or header syntax in email fields. Messages may gain unintended recipients or headers.

Unpublished drafts appear in a public response or cached page. Embargoed or incomplete material can leak.

Builder JavaScript inserts untrusted URL or content data into the page unsafely. The browser executes script even if the server response is static.

A database tool is reachable from the public internet without adequate controls. A second administrative surface may put site data at risk.

An API or plugin returns customer records to an unauthorized caller. Personal and purchase information may be exposed.

An external page induces an authenticated administrator to change an account. Users or roles may be created, deleted, or changed.

A signed-in administrator visits an external page that triggers a settings change. Configuration may change without the administrator intending it.

Multiple sites share writable files or database credentials. Compromise of one site may affect another.

A low-privilege account can create or modify coupons. An attacker may issue discounts that the store never approved.

An affected WordPress version remains unpatched after the July 2026 security release. The documented flaw can let an attacker influence a database query under the advisory's conditions.

A contributor gains an editor-only action through a plugin or custom route. The user may publish or alter content beyond their assigned role.

A form plugin stores uploaded attachments at guessable public URLs. Private submissions may be readable by anyone with the URL.

An update arrives from an untrusted or compromised distribution channel. Malicious code may be installed as if it were a routine update.

A backup option is passed unsafely to a system command. The server may execute unintended commands.

A third-party page frames an admin screen and tricks a user into clicking it. A legitimate session may carry out an unintended action.

A checkout extension accepts files without suitable type or authorization checks. Customer-supplied files may become a code or data exposure route.