← Academy

Vulnerabilities

This section explains how vulnerability classes form, which trust boundary fails, what attacker model is required, how impact should be demonstrated, and which patterns commonly produce false positives.

Planned article structure

Overview · Security Boundary · Vulnerable Pattern · Preconditions · Impact · WordPress Attack Surface · Testing Methodology · False Positives · Detection Checklist · References

IntroductionHow to reason about sources, sinks, state, trust, reachability, and impact.

Arbitrary File DeletionAttacker-controlled deletion paths and destructive file operations.

Arbitrary File ReadUnauthorized access to local files and sensitive application data.

Arbitrary File UploadUnsafe uploads, execution boundaries, extension checks, and storage location.

Broken Access ControlMissing authorization, ownership validation, and role enforcement.

Content InjectionUnauthorized modification or creation of application-controlled content.

Cross-Site Request Forgery (CSRF)State-changing requests performed through an authenticated victim.

Cross-Site Scripting (XSS)Stored, reflected, and DOM-based execution in browser contexts.

Local File Inclusion (LFI)Unsafe inclusion paths and local code or data exposure.

Open RedirectUntrusted destinations, phishing support, and redirect validation.

PHP Object InjectionUnsafe deserialization and gadget-chain reachability.

Privilege EscalationUnauthorized role, capability, or account privilege changes.

Race ConditionSecurity failures caused by unsafe timing and non-atomic state changes.

Remote Code Execution (RCE)Attacker-controlled execution through dangerous interpreters and sinks.

Sensitive Data ExposureUnauthorized disclosure of secrets, private records, and protected content.

Server-Side Request Forgery (SSRF)Server-initiated requests to attacker-selected destinations.

SQL Injection (SQLi)Untrusted data altering database query structure.

Type JugglingLoose comparison, coercion, and validation bypasses in PHP.