The most regularly seen attack type is script injection (XSS attack), rogue scripts are injected into the webpage for malicious purposes. This includes redirects to third-party websites, collecting user data, downloading malware to visitors, etc. WordPress has a bunch of useful developer functions that are used to sanitize data (Validating Sanitizing and Escaping User Data) … Read full article →
Arbitrary Code Execution is a process that enables an attacker to execute arbitrary code on a WordPress website. Hackers often break into a website by exploiting outdated plugins, themes, and even the WordPress core. They then upload a PHP file containing malicious codes. They use arbitrary codes to navigate and inspect your files and find … Read full article →
File inclusion vulnerabilities allow an attacker to read (and sometimes execute) files on the WordPress website, gain unauthorized access to sensitive information and inject malicious files through the “include” functionality. This can be very dangerous because if the webserver is misconfigured the attacker may gain access to sensitive user information and even execute arbitrary commands. There … Read full article →
SQL (Structured Query Language) is a language that allows code to interact with databases. Injecting SQL commands into a vulnerable user input section on your WordPress website such as a contact form or search box is considered an SQL Injection attack. Depending on the actual SQL command, this could purge the database, send the data … Read full article →
Full path disclosure (FPD) is a software bug that results in the full path to the webroot directory of the server being exposed. This is not necessarily a security risk, but can be used in combination with other vulnerabilities to create a real issue. In this guide We will explain the importance of Full Path … Read full article →