WPDeeply

Download free plugin

WordPress Vulnerability

15

Guides

All 54 Plugin Security 15 Security Research 12 Vulnerability Types 11 Security News 6 Hardening 5 Malware 5 WordPress Insights 4 RSS

WordPress Importer and _wp_attached_file: Why Imports Need Security Review Importers create content and file references from external data. If the importer trusts attachment metadata too much, a migration file can become a security boundary problem. Plugin Security 17 Jul 2020, 2 min WordPress Upload Any File with an Image Extension: Why Extension Checks Fail A file ending in .jpg is not automatically an image. Upload security must validate content, storage location, execution rules, and user capability. Vulnerability Types 13 Jul 2020, 2 min WordPress Null Byte to RCE: What an Old 0-Day Pattern Teaches Us Null byte issues are old, but the lesson is current: never trust file names, extensions, or paths until the exact runtime behavior is understood. Vulnerability Types 12 Jul 2020, 2 min WordPress Write Image to Any Directory RCE: File Writes and Code Execution An arbitrary file write becomes urgent when attackers can choose both content and location. If executable paths are reachable, image handling can turn into code execution. Vulnerability Types 12 Jul 2020, 2 min WordPress Arbitrary File Delete: How a Small Path Bug Can Break a Site Arbitrary file delete is serious because deleting the right file can disable security controls, break the site, or set up a second-stage takeover. Vulnerability Types 12 Jul 2020, 2 min