| name | wordpress-cors-xmlrpc-rce-chain |
| description | Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path. |
| version | 2.0.0 |
| license | MIT |
| platforms | ["linux","macos"] |
| compatibility | Requires curl, a browser, and approved WordPress test identities |
| tags | ["wordpress","cors","xmlrpc","chain","validation"] |
| category | redteam |
| related_skills | ["cross-attack-chains","hunt-cors","hunt-wordpress","triage-validation","xmlrpc-exploitation"] |
WordPress CORS, XML-RPC, and Upload Chain
This skill evaluates whether independently verified WordPress behaviors can
form a path to unauthorized file execution. It does not assume that CORS,
XML-RPC, registration, or an upload method is exploitable merely because it is
present.
When to Use
- Credentialed CORS exposes non-public WordPress data.
- XML-RPC returns a protocol-valid method list.
- An approved test identity has an upload-capable role.
- A plugin or core upload operation may accept an executable file.
- The assessment explicitly permits state-changing upload and execution tests.
Prerequisites
- Explicit authorization for each state-changing step.
- An approved synthetic account and test site or disposable content.
- Browser evidence for the CORS primitive.
- Protocol-valid XML-RPC evidence.
- Confirmed role capabilities and upload path.
- A benign test artifact and cleanup procedure.
How to Run
Create an evidence matrix before sending a state-changing request:
Primitive State Evidence
Credentialed CORS observed browser reads approved non-public data
XML-RPC method observed protocol-valid methodResponse
Upload-capable identity unverified role and capability still required
Executable storage path unverified handler and server behavior required
Cleanup planned test artifact and account removal
Stop when any prerequisite remains inferred.
Procedure
1. Validate Credentialed CORS
Use hunt-cors to prove that an untrusted origin can read non-public data with
an approved browser session. Header reflection or public REST content is not
enough.
Record which information the primitive supplies to the next step. Usernames,
nonces, or plugin metadata have different security value and may not enable
authentication or upload.
2. Classify XML-RPC
TARGET="https://www.example.test"
OUTPUT_DIR="${OUTPUT_DIR:-./output/wordpress-chain}"
mkdir -p "$OUTPUT_DIR"
curl -sS --max-time 15 \
-X POST "$TARGET/xmlrpc.php" \
-H 'Content-Type: text/xml' \
--data-binary \
'<methodCall><methodName>system.listMethods</methodName></methodCall>' \
-o
