XSS2Shell: New WordPress Core Vulnerability Could Enable Remote Code Execution

MITRE Techniques

• [T1059.007] Command and Scripting Interpreter: JavaScript – The attacker can execute JavaScript in the context of the WordPress domain by abusing the reflected XSS on the login page. (‘un attaccante può ottenere l’esecuzione di codice JavaScript nel contesto del dominio WordPress senza disporre preventivamente di credenziali valide’)
• [T1190] Exploit Public-Facing Application – The flaw affects the public WordPress authentication page and can be triggered remotely through crafted input. (‘vulnerabilità … interessa la pagina di autenticazione di WordPress’)
• [T1056.002] Input Capture: GUI Input Capture – The attack chain depends on an authenticated administrator interacting with an attacker-prepared page, enabling the attacker to abuse the victim’s session. (‘richiede che un amministratore WordPress già autenticato interagisca con una pagina predisposta dall’attaccante’)
• [T1566.002] Phishing: Spearphishing Link – Social engineering is required to lure the administrator into interacting with the malicious page. (‘richiede attività di social engineering e un’interazione esplicita della vittima’)
• [T1608.001] Stage Capabilities: Upload Malware – The demonstrated chain includes uploading a plugin to the WordPress system as part of reaching PHP execution. (‘al caricamento di un plugin e all’esecuzione di codice PHP sul server’)
• [T1505.003] Server Software Component: Web Shell – Post-compromise checks explicitly mention the possible presence of web shells or unrecognized PHP files on the site. (‘presenza di web shell o file PHP non riconducibili all’installazione’)