How I Successfully Bypassed Wordfence to Exploit SQLi in a Client's WordPress
This is the journey of how I successfully bypassed Wordfence WAF to exploit a SQL Injection in an updated WordPress and Wordfence. The vulnerability was present in a custom plugin developed for my client by a 3rd party. In this post I will explain how I discovered the vulnerability and how I exploited it, successfully bypassing Wordfence SQLi security measures. All the code used in this post can be found at the end of the post. For obvious reasons I will not share the client’s website or vulnerable code, instead I developed a simple lab with Docker. ...