WPDeeply
Download free plugin

Vulnerability Types

Plain-language explainers for the vulnerability classes that hit WordPress.

11
Guides
All 61 Plugin Security 22 Security Research 18 Vulnerability Types 11 Hardening 6 Security News 6 Malware 5 WordPress Insights 4 RSS
WP Activity Log before 4.1.5 unauthenticated SQLi Status: patched. This is a fix-verified writeup of an unauthenticated SQL injection we originally disclosed in WP Activity Log (then WP Security Audit Log, now sold by Melapress)… Vulnerability Types 9 Aug 2026, 5 min Remote Code Execution in WordPress, Explained The worst class, how plugins get there, and why cleanup is not the same as patching. Vulnerability Types 24 Jun 2026, 2 min CSRF in WordPress, Explained Nonces, why plugins skip them, and how a “moderate” flaw reaches code execution. Vulnerability Types 6 May 2026, 2 min Cross-Site Scripting (XSS) in WordPress, Explained Stored, reflected and why “it only affects admins” is the wrong conclusion. Vulnerability Types 8 Apr 2026, 2 min SQL Injection in WordPress, Explained What SQL injection is, why WordPress plugins keep producing it, and what it means when your site has one. Vulnerability Types 19 Mar 2026, 2 min WordPress and PHAR Unserialize: Why File Handling Can Become Code Risk PHAR unserialize risk is about file operations becoming object-deserialization triggers. If a plugin lets attackers influence file paths, normal-looking checks can become dangerous. Vulnerability Types 7 Aug 2020, 2 min WordPress and Multiple maybe_unserialize Calls: When Data Parsing Gets Risky Repeated unserialization is a smell. If user-influenced data is parsed again and again, developers should ask whether the application is normalizing data or accidentally expanding attacker control. Vulnerability Types 27 Jul 2020, 2 min WordPress Upload Any File with an Image Extension: Why Extension Checks Fail A file ending in .jpg is not automatically an image. Upload security must validate content, storage location, execution rules, and user capability. Vulnerability Types 13 Jul 2020, 2 min WordPress Null Byte to RCE: What an Old 0-Day Pattern Teaches Us Null byte issues are old, but the lesson is current: never trust file names, extensions, or paths until the exact runtime behavior is understood. Vulnerability Types 12 Jul 2020, 2 min WordPress Write Image to Any Directory RCE: File Writes and Code Execution An arbitrary file write becomes urgent when attackers can choose both content and location. If executable paths are reachable, image handling can turn into code execution. Vulnerability Types 12 Jul 2020, 2 min