9 posts tagged with CVE.
WP Directory Kit passed filter_ids through esc_sql() and inserted it unquoted into an IN clause. Quotes were never needed, so the escaping solved the wrong problem. How the bug worked across three sinks in two methods, why the public nonce did not make it authenticated, and how to find the same pattern.
Read more →
Easy Appointments registered a REST route with __return_true as its permission callback. One unauthenticated GET returned appointment rows and their custom fields. The vulnerable route, the fix, and a practical way to audit WordPress REST endpoints for the same mistake.
Read more →
CVE-2026-44982 was a single-header WAF bypass in the CrowdSec AppSec component. Same payload, Content-Length blocked, Transfer-Encoding: chunked passed through to the backend. The root cause was one line in pkg/appsec/request.go. The same shape shipped in an official CrowdSec bouncer and the main third-party Traefik integration, both addressed in subsequent releases without CVE assignment.
Read more →
CVE-2026-39534 was a custom-MVC dispatcher in WP Directory Kit that took a method name from POST and called it. No authentication, no nonce, no model allowlist. POST a model name, get the rows back. How the dispatcher pattern hides this class of bug and a checklist to find it in any plugin that ships its own MVC.
Read more →
CVE-2026-39511 was an unauthenticated SQL injection in the WP Photo Album Plus plugin. The query went through wpdb::prepare() correctly and then through stripslashes() right after, deleting the very escapes prepare() had just added. How the anti-pattern works, the exploitable payload and a checklist to grep your own plugin source for the same shape.
Read more →
CVE-2025-4392 was an unauthenticated stored XSS in the Shared Files plugin. A sanitizer that only ran for SVGs and silently passed everything else through. How the gate made the function's name a lie, and a checklist to grep your own plugin source for the same pattern.
Read more →
A walkthrough of CVE-2025-3769, an IDOR in the LatePoint plugin that exposed customer data from about 100K WordPress sites. How I found it, the code-review pattern behind it and a checklist for auditing WordPress plugins yourself.
Read more →
Both lines were written for security. One added protection, the other removed it. How $wpdb->prepare() and stripslashes() combined into a critical SQL injection.
Read more →
When critical CVEs drop, malicious scanners follow. Here's why you should review the code before running any security tool from GitHub.
Read more →