Hands-On Web Penetration Testing with Metasploit

WordPress exploitation part 1 – WordPress Arbitrary File Deletion

Now that you have learned about how to identify WordPress versions, let's look at some ways of exploiting WordPress in detail. We will also discuss how the exploit process works.

We will first look at the WordPress Arbitrary File Deletion vulnerability. This vulnerability allows any authenticated user to delete a file from the server. This can be used by an attacker to execute commands. Let's look at how this exploit works and how to achieve command execution.

The following screenshot shows the WordPress blog running on our localhost:

The vulnerability is actually a second-order ...