Private editorial-note substring oracle through REST pagination totals
The REST notes collection exposes pagination totals that vary with private editorial-note matches. An unauthorized caller can use the total as a substring oracle for another user’s private note content.
Global Styles preset fail-open and raw CSS rule breakout
WordPress Global Styles accepts attacker-controlled preset and raw CSS-rule data beyond the intended safe-style boundary. A lower-privilege authenticated user can persist styling that is rendered site-wide.
Font-family breakout into subsite-wide Global Styles CSS
The Font Library font-family value crosses into subsite-wide Global Styles CSS without sufficient delimiting/validation. A lower-privilege authenticated user can influence rendered CSS beyond the intended font declaration.
DNS-rebinding SSRF through pingback and URL-details fetches
WordPress URL validation resolves a host before the request but does not bind the security decision to the eventual connection. A DNS-rebinding hostname can therefore reach an internal address through authenticated URL-details or XML-RPC pingback flows.
Unauthenticated quadratic redirect sanitization through postpass
The post-password redirect path repeatedly applies replacement-based sanitization to attacker-controlled redirectto data. Long overlapping input can cause quadratic processing and exhaust a PHP worker.
Persistent quadratic block-parser memory exhaustion from an Author post
WordPress block parsing can repeatedly expand an unbalanced delimiter sequence supplied in an Author-controlled post. The parser retains and reprocesses nested/unbalanced state, causing quadratic CPU/memory cost.
Contributor-to-privileged-user stored XSS through Interactivity API URL binding
A Contributor can store Interactivity API context that is later bound to an anchor href. The PHP path rejects only event-like attribute names, while browser hydration applies the resulting value directly as an element attribute.