Code Review : Arbitrary Options Update

Here we are going to focus only one WordPress built-in function update_option

Predefined option update by low priv user (Medium)
Arbitrary option update by low priv user (High)

Difference is very easy to understand, in the first you can’t control the option name, but only trigger from low priv account, and in the arbitrary one, as the name implies, low priv or unauth users can control the argument and trigger or execute any option name 🙂

1️⃣ CVE-2025-5701

Plugin has been closed and installation link not available, but we can manually craft the download endpoint url based on the naming convention wordpress[.]org follows in general.

https://downloads.wordpress.org/plugin/hypercomments.1.2.2.zip