‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. zelphirkalt · · focus · HN ↗
    These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
    1. traceroute66 · · focus · HN ↗
      > WP would surely be among the top candidates

      And its closely related cousin, Joomla.

      1. bombcar · · focus · HN ↗
        Joomla makes WP look like Fort Knox.
        1. rmoriz · · focus · HN ↗
          Never forget PHPnuke and phpmyadmin
          1. pmlnr · · focus · HN ↗
            The internet was different when those two were conceived.
            1. tosti · · focus · HN ↗
              Easier to pwn.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.