Wordpress SQLi

There won’t be an intro, let us jump to the problem.

This is the wordpress database abstraction prepare method code:

public function prepare( $query, $args ) {
 if ( is_null( $query ) )
 return;

// This is not meant to be…

Wordpress SQLi — PoC

In order to understand the writing here, you need to read the previous explanation https://medium.com/websec/wordpress-sqli-bbb2afcc8e94. If you got it, then we can jump to the part and solve the question e.g. how to update / insert our sql payload into _thumbnail_id post meta.

Wordpress and the notorious unserialize

Few weeks back we got the following on the php bug reporting system https://bugs.php.net/bug.php?id=75006

Unserialize must not be used on untrusted input.
We don't consider issues in unserialize as security vulnerabilities

Authentication bypass / RCE on 300k live websites using mainwp-child < 3.4.5

Month ago I was performing a security audit on one web setup for a client and I have meet the mainwp-child plugin there. Looking at the code I have noticed a quite “interesting” issue there e.g. I…

WooCommerce and Azis with scotch

Most of the topics here are WordPress related, written with heavy sarcasm, as only way to reach the…

wp-job-manager ≤ 1.29.2 preauth POI / unserialize of user supplied data

Wordpress has gone trough interesting period of time. They have tried to fix critical vulnerabilities:

• https://hackerone.com/reports/179920

Wordpress 4.9.7 — RCE via Author

EDIT: Wordpress 4.9.8 is vulnerable too e.g. wasn’t security release.

Wordpress have suffered from Arbitrary file deletion that leads towards RCE. In our lovely relationship with WP PR person I have stated quite clearly that offered solution…

XSS vulnerability in iThemes Security (formerly Better WP Security) 5.6.1

Two weeks ago I was performing review of another security plugin https://wordpress.org/plugins/better-wp-security. I was impressed by the number of the active installations 800k+ and ofc. that is must to…

Wordpress 4.8.3 - wrecking ball

Wordpress 4.8.3 security “fix”, solved something already reported 10+ months ago and have introduced 3 new features:

• PHP object injection
• SQLi
• DoS

unauthenticated RCE in vaultpress-the most powerful backups and security for your Wordpress site

This summer I decided to start a security project, endpoint security implementing new strategy in order to protect online services. Also decided to create the PoC…