# Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)

WordPress's unauthenticated _jsonp callback, restricted to word/dot chars, is abused via Same Origin Method Execution to bypass strict CSP and escalate HTML injection to XSS/RCE.

- Payout: Research
- Severity: high
- Program: WordPress Core
- Credited: PWNAI Research
- Disclosed: 2022-05-29
- Write-up quality: 8/10
- Original: https://pwn.ai/blog/bypass-csp-using-wordpress-by-abusing-same-origin-method-execution
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-bypass-csp-using-wordpress-by-abusing-same-origin-method-execution
- Tags: domain:web impact:ato impact:rce kind:research platform:research sev:high tech:rest technique:chained technique:source-review vuln:access-control vuln:misconfiguration vuln:xss

**Target:** WordPress REST API /wp-json/wp/v2/users/1 _jsonp callback
**Root cause:** wp_is_jsonp_request() exposes a user-controllable _jsonp parameter reachable unauthenticated; wp_check_jsonp_callback() only strips non-word/dot chars, so a callback like document.body...click passes and is emitted as a same-origin script.
**Steps:**
1. Identify a site with strict CSP `script-src 'self'; object-src 'none'` and any WordPress endpoint on same origin/subdomain.
2. Confirm HTML injection on main domain (e.g. `?name=<script src=...>`).
3. Reference the WP JSONP endpoint: `https://SITE/blog/wp-json/wp/v2/users/1?_jsonp=window.opener.wpbody...click`.
4. Open victim admin plugin-install page in a window, then from child window redirect to the injection page loading the JSONP script.
5. JSONP returns `/**/window.opener.wpbody...click(...)` which clicks 'Install Now' on Contact Form 7.
6. Repeat the DOM-navigation click to hit 'Activate', achieving PHP execution.
**How found:** Noticed WordPress ships a hidden unauthenticated _jsonp parameter; reading load.php/functions.php showed sanitization only allows word chars and dots, prompting recall of Ben Hayek's SOME technique to invoke DOM methods without restricted characters.
**Exploitation:** Attacker page opens child window, redirects opener to victim's wp-admin plugin-install search page, then child navigates to the HTML-injection URL whose script src is the same-origin WP JSONP endpoint. The JSONP callback uses SOME DOM navigation (window.opener.wpbody...click) to click Install then Activate on a plugin, yielding RCE.
**Escalation:** HTML injection upgraded to XSS despite CSP, then chained to admin plugin install/activate for RCE.
**Insight:** When a JSONP/callback sink only permits [\w.], you can still invoke arbitrary DOM methods via SOME: chain property navigation from window.opener/document to reach a sensitive element and call .click, so a same-origin JSONP endpoint becomes a CSP-bypassing script gadget.