February 2017

Dealing with WordPress’ Unauthenticated Privilege Escalation Vulnerability in a REST API Endpoint

On Thursday, WordPress.org released WordPress 4.7.2, fixing the following four vulnerabilities. The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. Reported by David Herrera of Alley Interactive. WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is […]

More →