# Behind the Code: Identifying Zero-Day Exploits in WordPress
## 1 Introduction
When malicious scripts are inserted into these plugins, they can create potential backdoors in the system, providing gateways for unauthorized access. These backdoors are subsequently exploited by malicious actors to gain control over the site, steal data, or launch further attacks [15]. Traditionally, security measures in system design have focused primarily on defending against external attackers [16]. However, insider attacks have recently emerged as a significant concern, especially for websites with multiple administrators. Insider attacks can be particularly damaging because they exploit the trust and access privileges of internal users, making detection and prevention more challenging [17]. For WordPress sites, which often rely on a variety of plugins to enhance functionality, the risk is even greater. Poorly designed plugins that fail to properly validate and sanitize user inputs can easily become entry points for XSS attacks. Once an attacker exploitsa vulnerability in a plugin, they can inject malicious code that compromises the entire site [18]. Therefore, secure plugin design must now prioritize eliminating vulnerabilities on the admin side as well. This involves implementing robust input validation and output encoding practices, conducting thorough security testing, and regularly updating plugins to patch known vulnerabilities [19]. The major issue tackled by this research is the identification and analysis of zero-day vulnerabilities in WordPress plugins, which are widely used in web development. These plugins, while enhancing functionality, often introduce security risks due to improper input validation and outdated security practices. A significant example of such vulnerabilities is cross-site scripting (XSS), which allows attackers to inject malicious scripts into web pages viewed by other users [20]. The novelty of our proposed approach lies in its application of dynamic application security testing (DAST) principles to uncover these vulnerabilities. Unlike traditional static analysis methods, DAST involves real-time interaction with the application, simulating attack scenarios to identify and exploit security flaws as they occur. Our research provides a detailed examination of 23 popular WordPress plugins, identifying critical zero-day vulnerabilities in three of them. By highlighting the mechanisms and potential impacts of these vulnerabilities, our study offers valuable insights into the practical risks posed by these security flaws. The proposed DAST-based approach demonstrates its effectiveness in proactively detecting and mitigating these threats, thereby offering significant benefits to both developers and end-users by enhancing the overall security posture of WordPress-based websites [4; 20; 21]. Furthermore, our approach emphasizes the importance of continuous security testing and timely updates to mitigate the risks posed by evolving threats in the dynamic landscape of cybersecurity [22]. One effective method for ensuring the security of web applications is through the application of dynamic application security testing (DAST) principles [23]. Unlike static testing methods that analyze source code, DAST involves simulating external attacks on the application to identify vulnerabilities that malicious actors could exploit. This dynamic approach is particularly effective in uncovering weaknesses related to input validation, authentication, and session management. DAST works by interacting with a running application, sending various inputs, and observing the application's responses. This real-time interaction allows DAST tools to detect security flaws that might not be apparent through static code analysis alone. For example, by submitting a wide range of input data, DAST can identify whether the application correctly handles and sanitizes user inputs, preventing potential injection attacks such as SQL injection or XSS [24; 25]. The real strength of DAST lies in its ability to provide a comprehensive assessment of an application's security posture from an external attacker's perspective.