killchain-compendium/exploit/web/wordpress.md

Wordpress

ure_user_roles

• exploitdb 44595

• windsordeveloper

• Update user profile and append POST parameter to gain administrator role on user

&ure_other_roles=administrator

Shell Upload

• Msfconsole

exploit/unix/webapp/wp_admin_shell_upload

Template & Plugin Editing

• If template injection does not work, use plugin injection on akismet.php