fauzan-aldi/cve-2022-21661A Python PoC for CVE-2022-21661, adapted from z92g's Go PoC, designed to demonstrate the vulnerability in a more accessible scripting environment.
A Proof-of-Concept (PoC) exploit written in Python for CVE-2022-21661, which is a critical vulnerability in WordPress that allows an unauthenticated attacker to perform an object injection attack, which under certain conditions can lead to Remote Code Execution (RCE).
This implementation is inspired by z92g's Go-based PoC and aims to provide a more accessible and script-friendly version, especially for security researchers and CTF practitioners.
⚠️ This tool is intended solely for educational purposes and authorized testing. Using it on systems you do not own without permission is illegal.
Clone this repository and install the required dependencies with:
pip3 install -r requirements.txt
Run this script with a single URL or a file containing a list of URLs to check if the site is vulnerable to CVE-2022-21661:
usage: main.py [-h] [-u URL] [-f FILE]
Identifies CVE-2022-21661 in WordPress installations.
options:
-h, --help Show this help message and exit
-u URL, --url URL Single WordPress site URL to check.
-f FILE, --file FILE File containing a list of WordPress URLs (one per line).
Author: FauzanAldi
Check a single site:
python3 main.py -u https://example.com
Scan multiple WordPress sites from a URL list:
python3 main.py -f urls.txt