WordPress security
2 posts
Article
One ../ and the server hands over the wrong file
Unauthenticated WordPress path traversal lets an anonymous request select which file the server reads; execution follows where a code-executing sink exists.
Article
Identity Continuity Failure in WordPress Plugin Supply Chain Compromise
A set of 30 WordPress plugins contained identical backdoors with synchronized timestamps and shared obfuscation patterns. The failure stemmed from lack of identity continuity enforcement across the software lifecycle, allowing coordinated malicious uploads without detection.