https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html