WPDeeply

Download free plugin

WordPress Importer

3

Guides

All 51 Plugin Security 12 Vulnerability Types 11 Security Research 10 Hardening 5 Malware 5 Security News 5 WordPress Insights 4 RSS

WordPress Importer — Arbitrary Post Creation The official WordPress Importer accepts a structured file and creates content from it. WPDeeply’s 2021 disclosure examined what happens when the file is not trustworthy. Security Research 11 Mar 2021, 3 min WordPress Importer and _wp_attached_file: Why Imports Need Security Review Importers create content and file references from external data. If the importer trusts attachment metadata too much, a migration file can become a security boundary problem. Plugin Security 17 Jul 2020, 2 min WordPress Attached File Meta: Small Field, Big Security Consequences _wp_attached_file looks like simple media bookkeeping, but it influences how WordPress finds files. Any plugin that writes it should treat it as security-sensitive. Security Research 14 Jul 2020, 2 min