WordPress Exploits

This repository contains WordPress plugin exploit artifacts validated against real local Docker environments. The layout follows the practical split used by the aramosf/joomla_exploits repository.

Collections

• real-impact/ contains 50 black-box HTTP exploits with demonstrated security impact.
• conceptual-pocs/ contains real vulnerable code paths that require additional state, configuration, or chaining.
• docker/ contains the shared WordPress and MariaDB laboratory.
• validation/ contains the clean 50/50 retest summary from 2026-07-10.

Each real-impact CVE directory contains:

• a standalone Python exploit under exploits/;
• the vulnerable plugin source ZIP under vulnerable-plugin/;
• SOURCE.txt with origin and checksum information;
• Docker and setup material;
• the successful exploit output and setup output from the final retest;
• a CVE-specific README with root cause, prerequisites, reproduction, impact, and limitations.

Required Elementor or WooCommerce packages used by five scenarios are bundled under their respective dependencies/ directories. In total, this repository contains 59 tested ZIP archives: 51 vulnerable-plugin archives for the 50 real-impact CVEs, 3 conceptual-PoC archives, and 5 dependency copies.

Requirements

• Docker with Docker Compose
• Python 3.9 or newer
• requests (python3 -m pip install -r requirements.txt)

Usage

1. Enter a CVE directory under real-impact/.

2. Read its README.md, including the required prior state and exact version.

3. Start the shared lab:

   cd ../../docker
   ./setup.sh up

4. Return to the CVE directory, install the bundled ZIP as described in its README, run any setup_state.sh, and execute the script under exploits/.

The scripts accept an explicit target URL and only communicate through HTTP. Some CVEs use the PHP 7.4 lab on port 8091; their README calls this out.

Validation status

All 50 real-impact exploits were rerun from clean plugin/database/upload state against the bundled vulnerable versions on 2026-07-10. The final result was 50/50 PASS, with 50 successful impact postchecks and no setup failures. See validation/summary.tsv and validation/REPORT.md.

Bundled third-party source

The ZIP files are retained to make exact-version validation reproducible. They contain third-party WordPress plugin source and keep their upstream files and notices. Origins and hashes are recorded next to each vulnerable package. Review THIRD_PARTY.md before public distribution.

Safety

Use these artifacts only against systems you own or have explicit permission to test. Several scripts demonstrate remote code execution, account takeover, SQL injection, privilege escalation, arbitrary file deletion, or sensitive file disclosure.