---
id: 6150
title: "Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)"
source_domain: pwn.ai
source_url: "https://pwn.ai/blog/bypass-csp-using-wordpress-by-abusing-same-origin-method-execution"
published_at: "2022-05-29T11:00:00Z"
tags: ["vulnerability-research", "wordpress", "xss", "csp-bypass", "jsonp", "same-origin-method-execution"]
phying_url: "https://phying.com/item/6150"
lang: en
---

# Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)

## Summary

Paulos Yibelo's technique bypasses CSP on sites hosting any WordPress endpoint, abusing the hidden _jsonp parameter and Same Origin Method Execution to turn HTML injection into full XSS.

## Intelligence Metadata

- **Sources:** pwn.ai
- **Published:** 2022-05-29T11:00:00Z
- **Original:** https://pwn.ai/blog/bypass-csp-using-wordpress-by-abusing-same-origin-method-execution
- **Phying News:** https://phying.com/item/6150