domains / families / security / wordpress-cors-xmlrpc-rce-chain

wordpress-cors-xmlrpc-rce-chain

separate

Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.

When to use

• Credentialed CORS exposes non-public WordPress data.
• XML-RPC returns a protocol-valid method list.
• An approved test identity has an upload-capable role.
• A plugin or core upload operation may accept an executable file.
• The assessment explicitly permits state-changing upload and execution tests.

When not to use

• Assuming presence of CORS, XML-RPC, or upload methods implies exploitability
• Using password spraying or unauthorized credentials
• Deploying command shells
• Assigning compound impact without independent step confirmation

Skill page

Source