News for hackers. Stuff that matters.

A comment on Unpatched WordPress vulnerability allows code execution for authors. Parent comment

Re:Unpatched WordPress vulnerability allows code execution f... by joe_hills on Tuesday June 26, 2018 @03:00PM (#17403181)
Some sites have plugins that allow users to create accounts with minimal permissions.

An attacker could create such an account, then abuse a legitimate nonce to delete files.

[ Parent | on HN ]
Re:Unpatched WordPress vulnerability allows code execution f... by jajern on Tuesday June 26, 2018 @03:17PM (#17403279)
Not sure why someone would do this, but even without a plugin you can go to General Settings and set New User Default Role to Author. This would give any new accounts the ability to exploit this.
[ Parent | on HN ]
Re:Unpatched WordPress vulnerability allows code execution f... by claudiulodro on Tuesday June 26, 2018 @03:23PM (#17403330)
Yeah, I didn't notice the video in the article with the proof-of-concept demonstrates this. Thanks.
[ Parent | on HN ]