Collected research

WordPress Core RCE

Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part I

Netanel Rubin · Check Point Blog · 4 August 2015

Chained flaws in WordPress core let a read-only Subscriber edit posts: a missing post ID makes the capability check return an empty privilege array, a quick-draft handler hands out a valid CSRF token, and a 16MB list of taxonomy terms stalls one request long enough to win a race that makes the invented post ID real. CVE-2015-5623 and four related identifiers.

Record

Document

Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part I

Researcher

Netanel Rubin

Published by

Check Point Blog

Date

4 August 2015

Topic

Server

In the archive

• Collected in the 2015 research round

Tags

• privilege-escalation
• race-condition
• toctou
• auth-bypass
• csrf
• wordpress
• php
• cve
• attack-chain
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Netanel Rubin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.