Now that you have learned about how to identify WordPress versions, let's look at some ways of exploiting WordPress in detail. We will also discuss how the exploit process works.
We will first look at the WordPress Arbitrary File Deletion vulnerability. This vulnerability allows any authenticated user to delete a file from the server. This can be used by an attacker to execute commands. Let's look at how this exploit works and how to achieve command execution.
The following screenshot shows the WordPress blog running on our localhost:
The vulnerability is actually a second-order file deletion where we upload and edit an image, then we put the path of our file in the metadata. When the image is deleted, WordPress calls the unlink function to automatically remove the metadata that contains a path...