Security Research
Historical and current WordPress vulnerability disclosures.
36
Guides
Loginizer before 1.6.4 — Unauthenticated SQL Injection
An unauthenticated SQL injection in Loginizer’s brute-force protection, reachable from any WordPress login form. Fixed in 1.6.4 — and pushed to over a million sites by a rare…
Ninja Forms before 3.4.27.1 — Simple CSRF to RCE
A missing request-origin check in Ninja Forms let one crafted link, clicked by a logged-in administrator, escalate into code execution. Fixed in 3.4.27.1.
WooCommerce before 4.1.0 — Remote Code Execution
A security fix that reached millions of stores through a changelog line reading like routine maintenance — and the ecosystem of plugins that copied the original code.
WordPress Attachment API Functions and Any Post Type: The Hidden Risk
Attachment handling is security-sensitive because files, metadata, authorship, and post relationships meet in one place. Treat upload and attachment helpers as privileged code.
WordPress Core and MySQL String Comparison: Security Lessons for Plugin Developers
Database comparison rules can change security outcomes. Case sensitivity, collation, truncation, and loose comparisons can make two strings look equal when the application expected a strict check.
WordPress Attached File Meta: Small Field, Big Security Consequences
_wp_attached_file looks like simple media bookkeeping, but it influences how WordPress finds files. Any plugin that writes it should treat it as security-sensitive.