Tag
6posts tagged #exploit.
WP Compress ships version 7.20.01 to close a maximum-severity RCE that needs no login. Four other WordPress plugins carry critical bugs the same day, with two PHP object injections, one SQL injection, and one subscriber-level takeover.
A missing capability check in Frontend Admin by DynamiApps lets unauthenticated visitors escalate to administrator through a non-numeric user ID; update to 3.29.10 and audit accounts before other criticals in ProSolution WP Client, Solace Extra and ARForms.
An unauthenticated authorization bypass in Pods hands full admin to anyone who can reach the AJAX endpoint, and Templately's remote code execution needs only a subscriber account to fire.
Three unauthenticated authentication-bypass flaws in WordPress plugins were disclosed on the same day. Only User Profile Builder has shipped a fix; the other two remain open, alongside a critical file-deletion bug and two privilege-escalation flaws.
The link-factory plugin ships an operator-controlled REST API authenticated by a hardcoded Ed25519 key, and W3 Total Cache patches a stored XSS reachable through comment author names when its Lazy Load feature is enabled.
WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.
