WordPress CORS Misconfigurations Can Chain Into Full Remote Code Execution

Security researchers documented three real-world attack chains in 2024–2025 where misconfigured CORS headers in WordPress plugins escalated to full Remote Code Execution (RCE). The vulnerabilities were discovered during bug bounty engagements and all affected plugins have since been patched and publicly disclosed. The core issue arises when plugins reflect the HTTP Origin header into Access-Control-Allow-Origin while also setting Access-Control-Allow-Credentials to true, allowing any website to make authenticated requests on behalf of a victim. WordPress's central AJAX endpoint, admin-ajax.php, is particularly exposed because CORS policy is enforced at the server level rather than by the application itself. The three documented attack chains involve combinations of CSRF, arbitrary file upload, privilege escalation, settings poisoning, and nonce leakage — patterns researchers warn are broadly replicable across the WordPress plugin ecosystem.