Authentication Bypass in WooCommerce Payments (CVE-2023-28121)

This repository contains a Python exploit script targeting CVE-2023-28121, a privilege escalation vulnerability in WooCommerce Payments plugin versions prior to 5.6.2 for WordPress. The main file, 'CVE-2023-28121', is a standalone Python3 script that automates exploitation against multiple targets provided in a list file. It attempts to escalate privileges without authentication, extract credentials (username, password, email, version), and logs successful results to a local file ('results.txt'). Optionally, it can send notifications of successful exploitation to a specified Telegram chat using the Telegram Bot API. The script supports multi-threaded execution, configurable timeouts, and outputs a summary of results. The repository also includes a minimal README with usage instructions. No hardcoded target endpoints are present; the script operates on user-supplied target URLs. The exploit is operational and automates real-world exploitation, but does not include advanced payload customization or post-exploitation modules.

This repository contains a single Metasploit auxiliary module targeting a critical vulnerability (CVE-2023-28121) in the WooCommerce Payments plugin for WordPress (versions 4.8 to 5.6.2). The module exploits an authentication bypass by sending a specially crafted HTTP POST request to the WordPress REST API endpoint for user creation, using the 'X-WCPAY-PLATFORM-CHECKOUT-USER' header set to a valid administrator user ID. If successful, the exploit creates a new user with administrator privileges, granting the attacker full control over the WordPress site. The module allows the operator to specify the username, password, and email for the new admin account, or generate them randomly. The code is written in Ruby and is designed to be run within the Metasploit framework. The main entry point is the 'run' method, which attempts the exploit against multiple possible API endpoint paths to maximize compatibility with different WordPress configurations.

This repository contains a proof-of-concept exploit for CVE-2023-28121, targeting the WooCommerce Payments WordPress plugin (versions <= 5.6.1). The main file, CVE-2023-28121.py, is a Python script that sends a crafted HTTP POST request to the /wp-json/wp/v2/users REST API endpoint of a target WordPress site. The request includes a JSON payload to create a new user with administrator privileges, exploiting an authentication bypass or privilege escalation vulnerability. The script requires the attacker to specify the target host and port. If successful, it prints a success message; otherwise, it reports an error. The repository also includes a README.md with usage instructions. No detection or fake exploit code is present; the script is a functional PoC for privilege escalation via user creation.

This repository contains two Python scripts (mass-exploit-v1.py and mass-exploit-v2.py) that exploit CVE-2023-28121, an unauthenticated privilege escalation vulnerability in WooCommerce Payments plugin versions prior to 5.6.2 for WordPress. The scripts automate the process of mass-exploiting multiple WordPress sites by reading a list of target URLs and attempting to create a new administrator user on each vulnerable site. The v1 script uses hardcoded credentials, while v2 generates random usernames, emails, and strong passwords for each exploit attempt. Both scripts first check the plugin version by accessing the readme.txt file, then attempt to create a new admin user via the /wp/v2/users REST endpoint, leveraging a special header ('X-WCPAY-PLATFORM-CHECKOUT-USER') to bypass authentication. Successful exploits are logged to results.txt, including the site URL and credentials. The scripts use threading for concurrent exploitation and require the 'colorama', 'requests', and 'urllib3' Python packages. No fake or destructive code is present; the scripts are operational exploits that provide admin access to vulnerable sites.

This repository contains a proof-of-concept exploit for CVE-2023-28121, targeting the WooCommerce Payments plugin for WordPress. The exploit is implemented in Python (exploit.py) and is accompanied by a README.md describing its purpose. The exploit works by first checking the version of the WooCommerce Payments plugin via the public readme.txt file. If the version is below 5.6.2 (the vulnerable range), it proceeds to exploit the vulnerability by sending a specially crafted HTTP POST request to the WordPress REST API endpoint, creating a new administrator account with hardcoded credentials. The exploit requires the attacker to supply the base URL of the target WordPress site. The main attack vector is network-based, exploiting a misconfiguration or vulnerability in the plugin's REST API handling. No detection scripts or fake elements are present; the code is a functional proof-of-concept for unauthorized admin access.

This repository contains a Python 2.7 exploit script (CVE-2023-28121.py) targeting WooCommerce Payments plugin versions less than 5.6.2 for WordPress. The exploit leverages an unauthenticated privilege escalation vulnerability, allowing an attacker to create a new administrator account on the target site. The script reads a list of target domains from a user-supplied file, checks if the WooCommerce Payments plugin is present and vulnerable by fetching its readme.txt, and then attempts to create an admin user via the WordPress REST API. Successful credentials are saved to 'resulst.txt'. The repository also includes a README.md with usage instructions and references. The main attack vector is network-based, exploiting exposed WordPress REST API endpoints. The script is operational and automates exploitation across multiple targets.

This repository contains a working exploit for CVE-2023-28121, a critical authentication bypass and privilege escalation vulnerability in the WooCommerce Payments plugin for WordPress (versions 4.8.0 through 5.6.1). The exploit is implemented in Python (woo-request.py) and automates the process of targeting multiple WordPress instances (listed in targets.txt). The script checks if the target is reachable, then sends a specially crafted HTTP POST request to the vulnerable REST API endpoint, setting the 'X-WCPAY-PLATFORM-CHECKOUT-USER' header to impersonate an administrator (user ID 1). The payload creates a new administrator account on the target system. The repository also includes a detailed markdown report (Отчет CVE-2023-28121.md) describing the vulnerability, setup instructions for a test environment, and exploitation details. The main entry point is woo-request.py, which requires Python 3.8-3.11 and uses asyncio and aiohttp for asynchronous HTTP requests. The exploit is operational and provides full administrative access to compromised WordPress instances.