20-06-26, 01:14 PM
Looking for a working WordPress exploit. Requirements:
What I need:
- Unauthenticated RCE. Alternatively: privilege escalation to admin (subscriber → administrator role). Will consider UNION-based SQL injection with readable output (wp_users dump).
- Must work on WordPress 6.5+ with auto-updates enabled, PHP 8.0+
- WP core vulnerability preferred. If plugin-based: top-tier only (Elementor, WooCommerce, WPForms, Contact Form 7, Yoast, Jetpack, RankMath — 1M+ installs). Plugin must be exploitable with DEFAULT settings — no "admin must enable X feature" prerequisites.
What I'm NOT looking for:
- File upload to /wp-content/uploads/ (blocked by standard .htaccess)
- POP chains without code execution
- Blind time-based SQL injection with no controllable output
- XSS, CSRF, phishing, or social engineering vectors
- Config-specific exploits (rare PHP extensions, exotic server setup)
Delivery format:
- Demo PoC against a test site first (I'll set up a fresh WP instance, or you provide a demo)
- After verification: full source/script + instructions
- Exclusive (not a resale of existing exploit)
Budget: Price negotiable based on vector reliability. Escrow through forum.
Long-term: If you have a private bugtracker/feed with regular drops — open to ongoing partnership.
DM me.
What I need:
- Unauthenticated RCE. Alternatively: privilege escalation to admin (subscriber → administrator role). Will consider UNION-based SQL injection with readable output (wp_users dump).
- Must work on WordPress 6.5+ with auto-updates enabled, PHP 8.0+
- WP core vulnerability preferred. If plugin-based: top-tier only (Elementor, WooCommerce, WPForms, Contact Form 7, Yoast, Jetpack, RankMath — 1M+ installs). Plugin must be exploitable with DEFAULT settings — no "admin must enable X feature" prerequisites.
What I'm NOT looking for:
- File upload to /wp-content/uploads/ (blocked by standard .htaccess)
- POP chains without code execution
- Blind time-based SQL injection with no controllable output
- XSS, CSRF, phishing, or social engineering vectors
- Config-specific exploits (rare PHP extensions, exotic server setup)
Delivery format:
- Demo PoC against a test site first (I'll set up a fresh WP instance, or you provide a demo)
- After verification: full source/script + instructions
- Exclusive (not a resale of existing exploit)
Budget: Price negotiable based on vector reliability. Escrow through forum.
Long-term: If you have a private bugtracker/feed with regular drops — open to ongoing partnership.
DM me.