Security Research
Historical and current WordPress vulnerability disclosures.
54
Guides
WooCommerce before 4.1.0 — Remote Code Execution
A security fix that reached millions of stores through a changelog line reading like routine maintenance — and the ecosystem of plugins that copied the original code.
WordPress Attachment API Functions and Any Post Type: The Hidden Risk
Attachment handling is security-sensitive because files, metadata, authorship, and post relationships meet in one place. Treat upload and attachment helpers as privileged code.
WordPress Core and MySQL String Comparison: Security Lessons for Plugin Developers
Database comparison rules can change security outcomes. Case sensitivity, collation, truncation, and loose comparisons can make two strings look equal when the application expected a strict check.
WordPress Attached File Meta: Small Field, Big Security Consequences
_wp_attached_file looks like simple media bookkeeping, but it influences how WordPress finds files. Any plugin that writes it should treat it as security-sensitive.