📋 Vulnerability Overview

🧠 Technical Description

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file.

The vulnerability exists because an attacker can control the values passed to a PHP include statement through the Content-Dir HTTP header. By leveraging a PHP filter chain, an attacker can inject arbitrary PHP code without authentication — achieving full Remote Code Execution on the server.

Case Study

https://medium.com/@phantom_hat/cve-2023-6553-wordpress-backup-migration-1-3-7-case-study-31cb8275274b

Attack Flow

┌──────────┐    Content-Dir Header    ┌──────────────────────┐    include()    ┌──────────┐
│ Attacker │ ──── PHP Filter Chain ──▶│  backup-heart.php    │ ──────────────▶ │   RCE    │
│          │    (no auth needed)      │  (vulnerable file)   │                 │  on Host │
└──────────┘                          └──────────────────────┘                 └──────────┘

1. Reconnaissance — Detect the installed plugin version via readme.txt
2. Payload Generation — Construct a PHP filter chain that resolves to arbitrary PHP code
3. Exploit Delivery — Send the crafted chain in the Content-Dir header to the vulnerable endpoint
4. Command Execution — Execute OS commands through a deployed webshell

🗂️ Repository Structure

.
├── exploit.py              # 🎯 Clean, professional exploit (verbose mode supported)
├── fancy_exploit.py        # ✨ Fancy version — same exploit, better vibes
├── php_filter_chain.py     # 🔗 PHP filter chain generator module
└── README.md               # 📖 You are here

exploit.py — Professional Exploit

The primary, clean exploit script designed for professional use in security assessments and case studies. Features include:

• Clean, structured terminal output using Rich
• Phased execution (Recon → Payload → Delivery → Execution)
• Verbose mode (-v) for detailed operational output
• Vulnerability check-only mode (-C)
• Exploit summary table on completion

fancy_exploit.py — The Fancy Version ✨

A more expressive version of the same exploit with extra personality. Functionally identical to exploit.py but with a much more colorful presentation:

• 🎨 Colorful, rainbow-styled terminal output
• 🎭 Random kaomoji reactions (success, failure, attack faces)
• 🖼️ ASCII art banner
• 💎 Emoji-enhanced logging (💀 errors, ✨ successes, 🔥 attack phases)
• 📊 Styled mission report summary with emoji indicators

Note: Both scripts share identical attack logic — fancy_exploit.py simply wraps the experience in a more visually expressive output layer.

⚙️ Installation

Prerequisites

• Python 3.8+
• pip package manager

Setup

# Clone the repository
git clone https://github.com/<your-username>/CVE-2023-6553.git
cd CVE-2023-6553

# Install dependencies
pip install -r requirements.txt

Note: php_filter_chain.py is a local module included in the repository — no additional installation needed.

🚀 Usage

exploit.py

# Check if a target is vulnerable (recon only)
python3 exploit.py -u http://target.com -C

# Exploit and execute a command
python3 exploit.py -u http://target.com -c id

# Check vulnerability first, then exploit
python3 exploit.py -u http://target.com -C -c whoami

# Verbose mode for detailed output
python3 exploit.py -u http://target.com -c id -v

fancy_exploit.py

# Check if a target is vulnerable
python3 fancy_exploit.py -u http://target.com -C

# Exploit and execute a command
python3 fancy_exploit.py -u http://target.com -c id

# Check first, then exploit if vulnerable
python3 fancy_exploit.py -u http://target.com -C -c whoami

Command-Line Flags

📸 Exploit Phases

🔗 References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6553
• Wordfence Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e
• Vulnerable Source (L118): https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118
• PHP Filter Chains (Synacktiv): https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it
• PacketStorm: http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html
• Patch Changeset: https://plugins.trac.wordpress.org/changeset?old=3006541%40backup-backup&new=3006541%40backup-backup

🛡️ Remediation

• Update the Backup Migration plugin to version 1.3.8 or later
• Remove the plugin entirely if it is not in active use
• Implement a Web Application Firewall (WAF) rule to block suspicious Content-Dir headers
• Audit server logs for indicators of prior exploitation

⚠️ Disclaimer

This tool is provided for authorized security testing and educational purposes only.

Unauthorized access to computer systems is illegal under laws including the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and similar legislation worldwide. The author assumes no liability for misuse of this software.

Only use this tool against systems you own or have explicit written authorization to test.