Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#wordpress×
Sort
3 posts ← reset filters
SecuritySell Digital Products "Securely" — Unless Someone Submits a Coupon Code
The Premium Packages plugin for WordPress lets unauthenticated attackers dump your database through a coupon code field. Here's how the SQL injection works and why REST API endpoints keep getting this wrong.
Jul 28, 2026 · 8 min
SecurityWordPress Account Switcher Plugin: A Loose Comparison Turns Every Subscriber Into an Admin
CVE-2026-6456 exposes a critical privilege escalation in the WordPress Account Switcher plugin through a loose comparison flaw in its REST API. Here's how it works and what to do right now.
May 21, 2026 · 6 min- Security
SQL Injection in Creative Mail WordPress Plugin: Your WooCommerce Store's Checkout Data Is Wide Open
CVE-2026-3985 exposes a high-severity SQL injection in the Creative Mail WordPress plugin via the checkout_uuid parameter, affecting all versions up to 1.6.9. Here's how it works and what to do now.
May 20, 2026 · 6 min