.. / CVE-2018-7422

• LFI
• Nuclei
• Web

Exploit for WordPress Site Editor <=1.1.1 - Local File Inclusion (CVE-2018-7422)

Description:

WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.

Nuclei Template

View the template here CVE-2018-7422.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-7422.yaml

References: