darkcast/cve-2020-10257Shell exploit script for CVE-2020-10257, an unauthenticated RCE in the WordPress TRX Addons plugin that creates admin users via the wp-json API endpoint.
_____ _____ ___ __ ___ __ _ __ ___ ___ ____
/ __\ \ / / __|_|_ ) \_ ) \ ___/ |/ \_ ) __|__ |
| (__ \ V /| _|___/ / () / / () |___| | () / /|__ \ / /
\___| \_/ |___| /___\__/___\__/ |_|\__/___|___//_/
by darkcast
CVE-2020-10257: WordPress TRX Addons Plugin Unauthenticated Remote Code Execution (RCE) Vulnerability
Affected Plugin: TRX Addons Vulnerability Type: Unauthenticated Remote Code Execution (RCE) CVSS Score: 9.8 (Critical) Vulnerable Versions: Prior to version 2.5.1 Patch Available: Yes (Update to version 2.5.1 or later)
Description: CVE-2020-10257 affects the TRX Addons plugin for WordPress, which is a popular plugin used to enhance the functionality of WordPress themes. The vulnerability exists due to improper input validation in the wp-json/trx_addons/V2/get/sc_layout API endpoint. This flaw allows unauthenticated users to manipulate the request parameters and inject malicious data, leading to the ability to add new users with administrator privileges.
An attacker can exploit this flaw by sending a specially crafted request to the vulnerable API endpoint, which could result in the creation of a new user with administrative rights on the target WordPress site. This could allow attackers to gain full control of the website.
git clone https://github.com/Darkcast/CVE-2020-10257.git
cd CVE-2020-10257
chmod +x exploit.sh
The script accepts the following arguments:
-d for the domain (e.g., https://www.targetsite.com).
-u for the username (optional).
-p for the password (optional).
./exploit.sh -d https://www.targetsite.com
./exploit.sh -d https://www.targetsite.com -u admin -p mypassword