y .

c o m s ki
Exdeertm
b o r
e i t h Sam
y of K
Web
Perso n Service
a l p rop
l_my6
9@ yahAttacks
om
oo.c
WordPress Content Injection

Copyright © Exdemy.com
Wordpress Content Injection
● Create an exploit to change the post status to drafted using the Wordpress
Content Injection base exploit
m y . c o m r s ki lab
Exdeerty of Keitohm
● If you didn’t set up the vulnerable Wordpress locally, useb o
the online
Sam
n a l p rop yah oo.c
Perso l_my6
9@

Copyright © Exdemy.com
Wordpress Content Injection - Solution
● First of all you need to look at the REST API documentation to figure out what
parameters you can use
m y . c o mSam borski
●
○
The status parameter can have
e y ofvalue:
https://developer.wordpress.org/rest-api/reference/posts/#update-a-post
Ex4ddifferent K eith
ert prop om o.c
○ nal private
publish, future, draft, pending, yaho
Perso _my 6 9@
● Also the base exploit helps youl use the exploiting structure
● To add status change to the basic exploit you only need to add the line below,
i.e. replace line 61 with:
○ 'status': 'draft'
● You can download the full exploit from here:
○ https://exdemy.com/advanced-web-hacking/attachment/chapter07-wp-post-status-changer.py

Copyright © Exdemy.com
 y . c o m s ki
Exdeertm
b o r
e i t h Sam
y of K
n a l p rop yah oo.com
Perso l_my6
9@

Copyright © Exdemy.com