• create a PHP file with your payload (e.g., a reverse shell)
• set the variable payload_file_name to the name of this file (e.g., "shell.php")
• create a zip file containing the payload
• set the variable zip_file_to_upload to the PATH of this file (e.g., "/root/shell.zip")

2. Log in with an administrator account:

• set the variable target_url to the base URL of the target (DO NOT end the string with a slash /)
• set the variable admin_user to the username of the administrator account
• set the variable admin_pass to the password of the administrator account

3. Get the wpnonce using the get_wpnonce_upload_file() method

• there are actually 2 types of wpnonce:
• the first wpnonce will be retrieved via the get_wpnonce_edit_settings() method inside the PluginSetting class. This wpnonce allows us to change the plugin settings (see step 4)
• the second wpnonce will be retrieved via the get_wpnonce_upload_file() method inside the PluginSetting class. This wpnonce allows us to upload the file

4. Check if the plugin secure mode is enabled using the check_if_secure_mode_is_enabled() method inside the PluginSetting class

• if Secure Mode is enabled, the zip content will be placed in a folder with a random name. The exploit will disable Secure Mode. By disabling Secure Mode, the zip content will be placed in the main folder (see the payload_url variable). The method called to enable and disable Secure Mode is set_plugin_secure_mode(set_to_enabled:bool, wpnonce:str)
• if Secure Mode is NOT enabled, the exploit will upload the file but then it will NOT enable Secure Mode

5. Upload the file using the upload_file(wpnonce_upload_file: str) method

• after uploading, the server will respond with HTTP 200 OK but that does not mean the upload completed successfully. The response will contain JSON that looks like this: {"jsonrpc":"2.0","error":{"code":102,"message":"Please verify that the file you uploaded is a valid ZIP file."},"is_valid":false,"id":"identifier"} As you can see, it reports an error with code 102 but according to the tests I performed, the upload completed

6. Re-enable Secure Mode if it was enabled using the switch_back_to_secure_mode() method

7. Activate the payload using the activate_payload() method

• you can define the method to activate the payload. The reason behind this choice is that this exploit does NOT provide any payload. Since you can use a custom payload, you may want to activate it via an HTTP POST request instead of an HTTP GET request, or you may want to pass parameters

WHY DOES THE EXPLOIT EXPLOIT SECURE MODE?

According to the PoC for this vulnerability provided by WPSCAN, we can retrieve uploaded files by accessing the "Managed Imports" page. I don't know why, but after uploading any file, I could not see the uploaded file on that page (maybe the Pro version is needed?). I had to find an alternative and I did so by exploiting this option.

WPSCAN page: https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7

UPDATE November 6, 2022

During testing, I noticed that I was uploading an invalid XML file and that is why the file was not appearing in the "Managed Imports" page.

Anyway, this method of disabling secure mode is a bit more "stealthy" because the uploaded content is not visible on the admin page. If you want to see the upload on the admin page, more steps are required.

ANY ISSUES WITH THE EXPLOIT?

For the exploit to work effectively, please consider the following:

1. check the target_url and administrator credentials
2. check the path of the zip file and the name of the payload (they may differ)
3. if you are testing locally, try setting verify_ssl_certificate to False
4. you can use print_response(http_response) for further investigation