WordPress exploitation part 3 – WordPress 5.0.0 Remote Code Execution

In this section, we will look at the RCE vulnerability, which existed in WordPress version 5.0.0 and below. This exploit chains two different vulnerabilities to achieve code execution (path traversal and local file inclusion). Metasploit already has a module for this exploit.

Vulnerability flow and analysis

The first vulnerability is CVE-2019-8942, which overwrites the post meta entries:

The unsanitized user input is then passed onto wp_update_post(), which doesn't check for non-allowed post meta fields:

The attacker can overwrite the _wp_attached_file post meta-key to their malicious file. At this point, we have exploited CVE-2019-8942. Now...