WordPress Core Security Research: Pattern Overrides, Block Bindings rich-text, and Interactivity API hydration
Private research notes for an authorized local WordPress Core security lab.
This repository documents a local lab finding where a low-privileged Contributor can create a pending post containing a core/block reference with attacker-controlled Pattern Overrides content. During rendering, WordPress Block Bindings process the rich-text override and reinsert HTML through replace_rich_text( wp_kses_post( ... ) ). The reinserted markup can contain data-wp-* Interactivity API directives. In a browser, the Interactivity runtime hydrates data-wp-bind--href and transforms a safe href into a javascript: URL. When an authenticated administrator reviews and clicks the link, JavaScript executes in the administrator session.
- Low-privileged user:
contributor_test - Role: Contributor
- Attacker-created post status:
pending - Victim: authenticated Administrator
- Browser validation: Chrome/CDP
- Confirmed lab impact: administrator-session XSS leading to administrator account creation
Contributor via REST
-> pending post
-> core/block attrs.content
-> Pattern Overrides
-> Block Bindings rich-text
-> replace_rich_text( wp_kses_post() )
-> data-wp-* directives reinserted into DOM
-> Interactivity API hydrates data-wp-bind--href
-> href becomes javascript:
-> admin click
-> XSS in administrator session
-> administrator account creation in lab
- Pattern ID: 399
- Canary post ID: 402
- Takeover lab post ID: 403
- Created admin user in lab:
bbx_admin_178112402 - Created admin user ID: 13
This repository is intended for private, authorized research and responsible disclosure only. It does not contain production credentials, third-party targets, or a weaponized public exploit.
docs/ Technical write-up and root cause analysis
evidence/ Sanitized terminal outputs and CDP evidence
scripts/ Safe helper scripts for local reproduction checks
notes/ Scratch notes and triage notes