1. Royal Elementor Addons — Arbirary File Upload

We explore how a poorly secured AJAX endpoint allows any anonymous user (without being logged in) to upload files to the server. The vulnerability lies in the use of a globally exposed nonce in the frontend and the lack of capability validation in the handle_file_upload function. We demonstrate how to upload a .txt file (as a proof of concept) that becomes publicly accessible in the uploads directory, opening the door to malware and phishing attacks.

2. Appointment Hour Booking — CSS Injection

A user with the Editor role can inject arbitrary CSS code that is rendered across the entire site. Since saving custom styles is not restricted to administrators only, an attacker can perform a full defacement, create transparent phishing overlays to steal higher-privileged admin credentials, or exfiltrate data using CSS selectors.

3. Tutor LMS — SQL Injection

An Error-Based SQL injection in the status parameter of the withdrawals model. The issue occurs because the plugin relies on sanitize_text_field() to protect SQL queries, an unsafe practice that does not escape single quotes. We demonstrate how an attacker with management-level permissions can use EXTRACTVALUE to extract the administrator’s password hash directly from the database.

4. Better WP Security — SSRF

A REST API endpoint allows an administrator to force the server to perform external HTTP requests. Due to the lack of validation of the provided URL destination, the server can be used as a proxy to scan the internal corporate network or, even worse, to access cloud service metadata (AWS/GCP/Azure) and steal infrastructure credentials.

5. SAML SSO — SSRF

The IdP metadata import endpoint accepts arbitrary URLs without internal network validation. We demonstrate how an attacker can direct the request to loopback addresses (127.0.0.1) or protected internal services, exploiting the fact that the WordPress server blindly trusts the provided URL to retrieve XML configurations.

6. WooCommerce — Open Redirect

We analyze an Open Redirect vulnerability in the authorization component of the WooCommerce REST API (WC_Auth). The issue allows an attacker to supply an arbitrary return_url parameter that is not validated against a whitelist of allowed domains. We demonstrate how an attacker can disguise a legitimate authorization link so that, once the administrator approves the permissions, they are automatically redirected to a malicious phishing site. The use of wp_redirect() instead of wp_safe_redirect() is the core technical flaw explored in this flow.