wordpress-cors-xmlrpc-rce-chain

name	wordpress-cors-xmlrpc-rce-chain
description	Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.
version	2.0.0
license	MIT
platforms	["linux","macos"]
compatibility	Requires curl, a browser, and approved WordPress test identities
tags	["wordpress","cors","xmlrpc","chain","validation"]
category	redteam
related_skills	["cross-attack-chains","hunt-cors","hunt-wordpress","triage-validation","xmlrpc-exploitation"]

WordPress CORS, XML-RPC, and Upload Chain

This skill evaluates whether independently verified WordPress behaviors can form a path to unauthorized file execution. It does not assume that CORS, XML-RPC, registration, or an upload method is exploitable merely because it is present.

When to Use

• Credentialed CORS exposes non-public WordPress data.
• XML-RPC returns a protocol-valid method list.
• An approved test identity has an upload-capable role.
• A plugin or core upload operation may accept an executable file.
• The assessment explicitly permits state-changing upload and execution tests.

Prerequisites

• Explicit authorization for each state-changing step.
• An approved synthetic account and test site or disposable content.
• Browser evidence for the CORS primitive.
• Protocol-valid XML-RPC evidence.
• Confirmed role capabilities and upload path.
• A benign test artifact and cleanup procedure.

How to Run

Create an evidence matrix before sending a state-changing request:

Primitive                 State       Evidence
Credentialed CORS         observed    browser reads approved non-public data
XML-RPC method            observed    protocol-valid methodResponse
Upload-capable identity   unverified  role and capability still required
Executable storage path   unverified  handler and server behavior required
Cleanup                   planned     test artifact and account removal

Stop when any prerequisite remains inferred.

Procedure

1. Validate Credentialed CORS

Use hunt-cors to prove that an untrusted origin can read non-public data with an approved browser session. Header reflection or public REST content is not enough.

Record which information the primitive supplies to the next step. Usernames, nonces, or plugin metadata have different security value and may not enable authentication or upload.

2. Classify XML-RPC

TARGET="https://www.example.test"
OUTPUT_DIR="${OUTPUT_DIR:-./output/wordpress-chain}"
mkdir -p "$OUTPUT_DIR"

curl -sS --max-time 15 \
  -X POST "$TARGET/xmlrpc.php" \
  -H 'Content-Type: text/xml' \
  --data-binary \
  '<methodCall><methodName>system.listMethods</methodName></methodCall>' \
  -o