mashaz/wp-plugins-poc

Collection of WordPress Plugin PoC - For Educational Purposes ONLY

WordPress Plugin PoCs

WordPress Plugin PoCs based on 1-Day WordPress Plugin Vulnerability

⚠️ Legal Disclaimer - Use At Your Own Risk ⚠️

This project is made for EDUCATIONAL and ETHICAL TESTING purposes ONLY. Using of source code in this repository for attacking targets without prior mutual consent is ILLEGAL.

I take NO responsibility and/or liability for how you choose to use any of information including source code in this repository. By accessing and using any of files in this repository, you AGREE TO USE AT YOUR OWN RISK. Once again, ALL files available here are for EDUCATIONAL and ETHICAL TESTING purposes ONLY.

List of PoCs

All PoCs are written in Python 3.6.8

• WP GDPR Compliance 1.4.2

  • Vulnerability Type: Remote Code Execution
  • Vulnerable Version: WP GDPR Compliance 1.4.2 or Lower
  • Dependency: Mailhog
  • References:
    • WordPress WP GDPR Compliance Plugin Privilege Escalation (Rapid7/Metasploit)
    • CVE-2018-19207 (CVE Details)

• Audio Record 1.0

  • Vulnerability Type: Arbitrary File Upload
  • Vulnerable Version: Audio Record 1.0 or Lower
  • References
    • WordPress Plugin Audio Record 1.0 - Arbitrary File Upload (ExploitDB)

• WeChat Broadcast 1.2.0

  • Vulnerability Type: Local File Inclusion
  • Vulnerable Version: WeChat Broadcast 1.2.0 or Lower
  • References
    • CVE-2018-16283 (CVE Details)
    • WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion (ExploitDB)