Pritect@PritectAug 28, 2025Reported in 2016 (via @Hacker0x01): logged in @WordPress users could run arbitrary shortcodes. Fixed in 6.3.2 many years later. Who's looking out for third-party plugin developers?pritect.netLogged in WordPress users could execute arbitrary shortcodes... or how not to run a bug bounty...WordPress core < 6.3.2 allowed any logged in user to execute arbitrary shortcodes. This issue was report in July 2016 and was finally resolved in October 2023. Around June 2023 another hackerone user...8
Pritect@PritectJul 25, 2022#WordPress plugin Advanced Custom Fields < 5.12.3 can allow unauthenticated users to upload arbitrary files @wpacf @dliciousbrainspritect.netAdvanced Custom Fields < 5.12.3 can allow unauthenticated users to upload arbitrary files - Pritect...Arbitrary File Upload Advanced Custom Fields and Advanced Custom Fields Pro have 2+ million installs according to wordpress.org. Versions older than 5.12.3 allow unauthenticated users to upload...
Pritect@PritectNov 27, 2017Elementor Page Builder #WordPress plugin version <= 1.7.12 allows logged in users unrestricted editing @elemntorpritect.netElementor Page Builder < 1.8 allows logged in users unrestricted editing - Pritect NetworkElementor Page Builder versions less than 1.8 contain a major security issue that allows logged in users (not just admin) unrestricted access to the Elementor specific backend functions. This allows...1
Pritect@PritectApr 18, 2017#WordPress shortcode injection as an attack vectorpritect.netWordPress shortcode injection as an attack vector - Pritect NetworkSummary This is not about a specific vulnerability but an intrusion vector often overlooked by WordPress plugin and theme developers. Frequently code is used that allows attackers to execute arbitr...
Pritect@PritectDec 21, 2016No @bluehost, it is not ok to aggressively cache HTTP GET requests that the response contains a Set-Cookie header
