---
title: "CORS Like You’ve Never Seen"
description: "Wildcard origins, reflected origins and the WordPress API trap: the CORS misconfigurations that lead to account takeover, and how to spot them fast."
canonical_url: "https://amrelsagaei.com/cors-like-youve-never-seen"
last_updated: "2025-08-21"
---

<post-media video="2BjOI-cwT88">



</post-media>

When I first started seeing CORS bugs, I thought… “Okay, cool, but this is probably nothing serious.”<br />


Wrong.

In this breakdown, we’ll hit the **4 most dangerous CORS mistakes** I keep finding, how to spot them fast, and why they can lead to account takeover, data leaks, and even complete system compromise.

### **1. The Wildcard Disaster**

When `Access-Control-Allow-Origin` is set to `*` *and* `Access-Control-Allow-Credentials` is `true`, you’ve basically given any origin full access to your authenticated data.<br />

**What to check:**

- Send an Origin header with any random domain, if the response allows it *and* credentials, you’re in.
- Look for sensitive API responses that return user data, tokens, or configuration.
- Test both GET and POST requests, some endpoints are protected differently.

### **2. The Reflection Trap**

The server takes whatever Origin you send… and reflects it back in the `Access-Control-Allow-Origin` header.<br />


With `Access-Control-Allow-Credentials: true`, this becomes dangerous: your malicious site can make the request *as the victim*, and the browser will happily send their cookies.<br />

**What to check:**

- Can you grab an authenticated API response from your own domain?
- Does the site cache the response headers? If yes, think **cache poisoning**: you can poison it once, and every visitor gets the bad header.
- Test across subdomains, sometimes only part of the app is vulnerable.

### **3. The WordPress API Trap**

A lot of WP sites leave `/wp-json/` open to the world with permissive CORS rules.<br />

**Why it’s bad:**

- Many plugins and themes expose sensitive or admin-only endpoints through this API.
- Some allow reading draft posts, user emails, or even nonce tokens.<br />

**What to check:**
- See if authenticated-only data is exposed when cookies are sent.
- Check plugin-specific API routes for private data leaks.

### **4. The Ruby Breakdown**

Rails apps often use the `rack-cors` gem, and if it’s misconfigured, you can access internal or authenticated endpoints from anywhere.<br />

**What to check:**

- Look for `origins '*'` with `credentials: true`.
- See if specific controllers or environments override CORS rules inconsistently.
- Always test staging environments, dev teams often forget to lock them down.

### **5. Tools to Catch It Fast**

- **Corsy**: quick CORS scanner for broad sweeps.
- **Scanner (Caido Plugin)**: catch CORS along with other bug classes during recon.

**The Real Hacker Mindset**<br />


Most hunters shrug at CORS. They see it as “informational” and move on.<br />


But combine it with **XSS**, **CSRF**, or **cache poisoning**, and you’re looking at account takeover, password resets, or sensitive data exfiltration.

**Final Words**<br />


The next time you see a “boring” CORS issue… stop. Test it. Chain it. Escalate it.<br />


The boring bugs are often the ones with the biggest payouts.

**Stay curious, and stay secure. 🔐🔥**

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.