Type Juggling Authentication Bypass in Post SMTP WordPress Plugin

This repository contains a Python proof-of-concept exploit for CVE-2023-6875, targeting the PostSMTP Mailer WordPress plugin (versions <2.8.8). The exploit automates an unauthorized account takeover by abusing the plugin's API endpoints to obtain a password reset token, intercept the reset key from plugin logs, and reset the password for a specified user. The repository consists of a README.md describing the exploit and a single Python script (exploit.py) implementing the attack. The script requires the target URL, username, and new password as arguments, and performs version checking, token acquisition, password reset request, log retrieval, and password change. The attack vector is network-based, exploiting exposed HTTP endpoints on the target WordPress site. The exploit is operational and demonstrates a full account takeover workflow.

This repository contains a Go-based exploit targeting WordPress installations with the Post SMTP plugin (or similar REST API endpoints). The exploit automates a multi-step attack: 1. It probes for accessible Post SMTP API endpoints to place a token and interact with the mail system. 2. It attempts to enumerate the admin username via the REST API, defaulting to 'admin' if not found. 3. It triggers a password reset for the admin account, then retrieves the reset link from the mail logs exposed by the plugin's API. 4. Using the reset link, it sets a new admin password and logs in as the admin user. 5. Finally, it uploads a ZIP file containing a PHP web shell as a WordPress plugin and provides the attacker with a URL to access the shell. The exploit is operational and provides remote code execution via the uploaded shell. The main code is in 'exploit.go', and the repository also includes a README.md with usage instructions. The attack vector is network-based, requiring access to the target's web interface and specific API endpoints. Several fingerprintable endpoints are hardcoded or constructed based on the target domain, including REST API endpoints and the final shell URL.