Adding Exploit for Wordpress plugin - WPvivid Backup - CVE-2022-2863

[tehtbl]

Template / PR Information

• Adding Exploit for Wordpress plugin - WPvivid Backup - CVE-2022-2863
• References:

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

[DhiyaneshGeek]

@tehtbl Hey, Thanks for sharing the template with the community :)

i tried to replicate this issue on the vulnerable plugin 0.9.75 and 0.9.74 version.

Could not replicate it , could tell me is there any setting need to be changed ?

[tehtbl]

Hi @DhiyaneshGeek, thanks for having a look at it.

I was working with the 0.9.75 version of the plugin. I've didn't changed any setting at all. Maybe you could try making a backup through WPvivid first before using the exploit. That was the only thing I've did.

cheers,
Thomas

Please find attached my test setup, configurations and debug output from nuclei itself.

127_0_0_1:31337_wpvivid_backup_lfi.txt
config.yaml.txt
docker-compose.yml.txt
Dockerfile.txt
uploads.ini.txt

[tehtbl]

@DhiyaneshGeek did you made any progress so far? Is there anything I could do to help making progress?

[DhiyaneshGeek]

@tehtbl Thanks a lot, i have validated it :)