WordPress Core
7
Guides
WordPress Importer — Arbitrary Post Creation
The official WordPress Importer accepts a structured file and creates content from it. WPDeeply’s 2021 disclosure examined what happens when the file is not trustworthy.
WordPress $wpdb->prepare(), Denial of Service, and Memory Limits
The practical risk is not that every use of $wpdb->prepare() is dangerous. The risk is that database helper code can become a denial-of-service path when untrusted input creates…
WordPress Attachment API Functions and Any Post Type: The Hidden Risk
Attachment handling is security-sensitive because files, metadata, authorship, and post relationships meet in one place. Treat upload and attachment helpers as privileged code.
WordPress and Multiple maybe_unserialize Calls: When Data Parsing Gets Risky
Repeated unserialization is a smell. If user-influenced data is parsed again and again, developers should ask whether the application is normalizing data or accidentally expanding attacker control.
WordPress Core and MySQL String Comparison: Security Lessons for Plugin Developers
Database comparison rules can change security outcomes. Case sensitivity, collation, truncation, and loose comparisons can make two strings look equal when the application expected a strict check.
WordPress Updates from Core and Security: How to Read Patch Signals
Do not wait for a dramatic changelog line. Many serious WordPress fixes arrive in plain maintenance language, and attackers read the diff faster than most site owners read…
WordPress Attached File Meta: Small Field, Big Security Consequences
_wp_attached_file looks like simple media bookkeeping, but it influences how WordPress finds files. Any plugin that writes it should treat it as security-sensitive.