Wordpress Archives — LinuxSec Exploit https://exploit.linuxsec.org/tag/wordpress/ Nothing is Ever Locked Wed, 14 Aug 2019 17:40:39 +0000 en-US hourly 1 https://wordpress.org/?v=6.4.3 WordPress 4.7.0/4.7.1 Content Injection Exploit https://exploit.linuxsec.org/wordpress-470471-content-injection/ https://exploit.linuxsec.org/wordpress-470471-content-injection/#comments Thu, 02 Feb 2017 20:18:00 +0000 https://exploit.linuxsec.org/2017/02/03/wordpress-470471-content-injection/ Celah ini menginfeksi  WordPress REST API yang ditambahkan secara default pada WordPress 4.7.0. Salahsatu API tersebut memungkinkan kita mengupdate menghapus mengedit dan menambahkan konten di WordPress. Sayangnya fitur ini malah memiliki celah yangmana pengunjung situs yang bukan admin pun dapat mengupdate konten website melalui API tersebut. Untuk detail lebih jauh cek di https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html Exploit : WordPress […]

The post WordPress 4.7.0/4.7.1 Content Injection Exploit appeared first on LinuxSec Exploit.

]]> https://exploit.linuxsec.org/wordpress-470471-content-injection/feed/ 4 Exploit WordPress Ajax Load More PHP Upload Vulnerability https://exploit.linuxsec.org/exploit-wordpress-ajax-load-more-php/ https://exploit.linuxsec.org/exploit-wordpress-ajax-load-more-php/#respond Tue, 03 Nov 2015 05:19:00 +0000 https://exploit.linuxsec.org/2015/11/03/exploit-wordpress-ajax-load-more-php/ Yooshh.. jumpa lagi kali ini saya akan share tutorial Wordpress Ajax Load More PHP Upload Vulnerability. Exploit ini membutuhkan metasploit. Jadi yang belum install , bisa install dulu. Exploit source nya dari Exploit-DB . Langsung saja ke tutorial. Download Exploit nya disini : https://www.exploit-db.com/exploits/38660/ Tambahkan module diatas ke metasploit kalian . Jika masih ada yang bingung bisa […]

The post Exploit WordPress Ajax Load More PHP Upload Vulnerability appeared first on LinuxSec Exploit.

]]> https://exploit.linuxsec.org/exploit-wordpress-ajax-load-more-php/feed/ 0 WordPress Security – Mencegah Brute Force pada XMLRPC WordPress https://exploit.linuxsec.org/wordpress-security-mencegah-brute-force/ https://exploit.linuxsec.org/wordpress-security-mencegah-brute-force/#comments Wed, 21 Oct 2015 00:58:00 +0000 https://exploit.linuxsec.org/2015/10/21/wordpress-security-mencegah-brute-force/ Baru baru ini telah ditemukan trik bruteforce pada file xmlrpc.php CMS WordPress. Berbeda dengan bruteforce halaman login yang mungkin sudah diantisipasi dengan htaccess ataupun plugins, bruteforce pada file xmlrpc.php ini tidak berbekas. Jika terdapat banyak log percobaan login saat kita mencoba bruteforce wp-login.php, bruteforce xmlrpc.php hanya meninggalkan satu log percobaan. 194.150.168.95 – – [07/Oct/2015:23:54:12 -0400] […]

The post WordPress Security – Mencegah Brute Force pada XMLRPC WordPress appeared first on LinuxSec Exploit.

]]> https://exploit.linuxsec.org/wordpress-security-mencegah-brute-force/feed/ 1 Deface WordPress dengan Exploit Themes Qualifire File Upload Vulnerability https://exploit.linuxsec.org/deface-wordpress-dengan-exploit-themes/ https://exploit.linuxsec.org/deface-wordpress-dengan-exploit-themes/#comments Fri, 05 Jun 2015 14:40:00 +0000 https://exploit.linuxsec.org/2015/06/05/deface-wordpress-dengan-exploit-themes/ Yuppp.. lama ya tidak share exploit deface. Kali ini saya mau share tutorial deface WordPress dengan Exploit Themes Qualifire File Upload Vulnerability . Exploit nya sudah lama sih sebenarnya, namun gak tau kenapa sekarang “bersemi kembali” . Oke gak usah lama lama , langsung saja . Bahan : HTML Exploit : download Google Dorks : inurl:”/wp-content/themes/qualifire” […]

The post Deface WordPress dengan Exploit Themes Qualifire File Upload Vulnerability appeared first on LinuxSec Exploit.

]]> https://exploit.linuxsec.org/deface-wordpress-dengan-exploit-themes/feed/ 1 Exploit WordPress Plugin WP Mobile Edition Local File Disclosure Vulnerability https://exploit.linuxsec.org/exploit-wordpress-plugin-wp-mobile/ https://exploit.linuxsec.org/exploit-wordpress-plugin-wp-mobile/#respond Wed, 15 Apr 2015 11:04:00 +0000 https://exploit.linuxsec.org/2015/04/15/exploit-wordpress-plugin-wp-mobile/ Yupp, kali ini mau share lagi exploit pada WordPress yang memiliki celah pada plugins WP Mobile Edition. Plugin ‘WP Mobile Edition’ ini tidak memfilter parameter GET file di /themes/mTheme-Unus/css/css.php . Alhasil kita juga dapat melihat source dari konfigurasi WordPress yang terletak di wp-config.php . Oke langsung saja. Google Dorks : inurl:?fdx_switcher=mobile Exploit : 127.0.0.1/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php Tested […]

The post Exploit WordPress Plugin WP Mobile Edition Local File Disclosure Vulnerability appeared first on LinuxSec Exploit.

]]> https://exploit.linuxsec.org/exploit-wordpress-plugin-wp-mobile/feed/ 0