Subscriber-to-author comprehensive WordPress data breach through legacy handlers
The supplied chain combines four low-privilege disclosure paths: approved-comment PII to a Subscriber, userlogin enumeration to a Contributor, unpublished-post title enumeration to an Author, and private attachment/file disclosure to an Author. Together they can expose private content and identity data; self-registration and each capability or configuration are prerequisites.
Contributor-to-internal-network reflected SSRF proxy through URL details
A Contributor can use the URL-details endpoint as a reflected server-side HTTP proxy. The supplied chain analysis combines the reflected metadata fields with the shared special-use IP validator gap and DNS-resolution TOCTOU. Reading internal services is demonstrated by the component report; broader network mapping and cloud metadata access depend on reachable services and configuration.
Unauthenticated administrator takeover via username disclosure and XML-RPC multicall
A username-disclosure path and unbounded XML-RPC multicall can be combined into a low-noise password-guessing channel against known privileged WordPress accounts. Reaching administrator access and arbitrary PHP execution is conditional on a successful password guess and the site configuration; the supplied chain does not establish universal compromise.
Unauthenticated cloud-account compromise via pingback SSRF and DNS rebinding
An unauthenticated XML-RPC pingback request can make a WordPress server fetch an attacker-controlled URL. The supplied chain analysis combines that server-side request with an incomplete special-use IP-range check and a DNS-resolution time-of-check/time-of-use gap. On a cloud-hosted deployment this can expose internal metadata services; IAM-credential theft depends on the cloud provider, metadata mode, instance role, and a usable response-exfiltration path.
Block custom-CSS edit_css filter bypass through a block-recognizer differential
The custom-CSS security gate relies on a block-recognition condition that differs from the parser’s accepted whitespace forms. An Author can therefore retain block custom CSS despite lacking editcss.
REST arrays have no item-count cap and JSON bypasses input-variable limits
REST collection array parameters accept unbounded item counts. JSON bodies and method override can bypass practical URL/input-variable limits, increasing query and validation work.
Anonymous trackback content insertion and author/URL spoofing
The trackback endpoint accepts attacker-controlled author, URL and content fields without a reliable authenticity boundary, allowing anonymous comment insertion and spoofing.
Nested QuickTime upload exhausts getID3 worker memory
A crafted QuickTime container can recurse through nested atoms without a depth budget during normal video metadata processing, exhausting PHP worker memory.
Host-driven canonical open redirect
Host-derived canonical redirect construction can reflect an attacker-controlled Host value into a redirect target, producing an open redirect and cache-poisoning condition.
Unauthenticated trackback source-IP disclosure on non-public posts
The unauthenticated trackback-ping response discloses source and commenter IP information for non-public posts.
Private-taxonomy term metadata disclosure through block bindings
Block bindings can expose term metadata from a taxonomy that is not publicly queryable or REST-visible when the bound term-data source is rendered.
Subscriber disclosure of commenter email and IP through XML-RPC
The XML-RPC wp.getComments path returns commenter email and source IP to a Subscriber-level caller when those fields are present.
Cross-user enumeration of unpublished post metadata through find_posts
The findposts AJAX handler can return metadata for other users’ private posts/pages and provides a full-text match oracle through the ps parameter.
Concurrent media uploads overwrite one another and share one path
Concurrent uploads can select the same available filename before either request commits its file, causing two uploads to share or overwrite one path.
Contributor creates a live private post through metaWeblog.newPost
The XML-RPC metaWeblog.newPost implementation accepts a private post status from a Contributor path that does not require publishposts. This creates a live private post rather than a normal draft.
Quadratic comment-author URL cookie processing on every request
The commentauthorurl cookie is processed on ordinary requests through repeated replacement logic. A long overlapping value can induce quadratic CPU work without authentication.
Anonymous REST _embed query fan-out amplification
The REST embed option can fan out one collection request into many embedded subrequests. Each item can trigger additional queries and response preparation, creating an amplification path for unauthenticated clients.
Interactivity style binding bypasses the server-side safe-style list
WordPress Interactivity API style binding: Style binding value and safe-style allowlist exhibits the validated behavior described in this advisory. The public record is intentionally bounded and does not include a turnkey exploit.
Attachment re-parenting to an unauthorized target post
The attachment AJAX handlers authorize the attachment being edited but not the caller-supplied target post. An Author can set an owned attachment’s postparent to another user’s protected post.
Approved comments on unpublished posts disclosed through singular feeds
Singular comment feeds can include approved comments attached to non-public posts. The feed query does not consistently apply the post visibility boundary before emitting comment content.