Security Research
Historical and current WordPress vulnerability disclosures.
20
Guides
WordPress Security Testing (2026 Update)
Short answer: you can’t verify a WordPress security vendor’s claims by reading their marketing page — you verify them by checking what’s actually testable: their CVE disclosure history,…
WordPress Importer — Arbitrary Post Creation
The official WordPress Importer accepts a structured file and creates content from it. WPDeeply’s 2021 disclosure examined what happens when the file is not trustworthy.
WordPress $wpdb->prepare(), Denial of Service, and Memory Limits
The practical risk is not that every use of $wpdb->prepare() is dangerous. The risk is that database helper code can become a denial-of-service path when untrusted input creates…
Abandoned Cart Lite for WooCommerce before 5.8.2 — SQL Injection
Unsanitised cart parameters in Abandoned Cart Lite for WooCommerce exposed stored customer data to unauthenticated extraction. Fixed in 5.8.3.
Loginizer before 1.6.4 — Unauthenticated SQL Injection
An unauthenticated SQL injection in Loginizer’s brute-force protection, reachable from any WordPress login form. Fixed in 1.6.4 — and pushed to over a million sites by a rare…
Ninja Forms before 3.4.27.1 — Simple CSRF to RCE
A missing request-origin check in Ninja Forms let one crafted link, clicked by a logged-in administrator, escalate into code execution. Fixed in 3.4.27.1.
WooCommerce before 4.1.0 — Remote Code Execution
A security fix that reached millions of stores through a changelog line reading like routine maintenance — and the ecosystem of plugins that copied the original code.
WordPress Attachment API Functions and Any Post Type: The Hidden Risk
Attachment handling is security-sensitive because files, metadata, authorship, and post relationships meet in one place. Treat upload and attachment helpers as privileged code.
WordPress Core and MySQL String Comparison: Security Lessons for Plugin Developers
Database comparison rules can change security outcomes. Case sensitivity, collation, truncation, and loose comparisons can make two strings look equal when the application expected a strict check.
WordPress Attached File Meta: Small Field, Big Security Consequences
_wp_attached_file looks like simple media bookkeeping, but it influences how WordPress finds files. Any plugin that writes it should treat it as security-sensitive.