CVE-2013-0235
WordPress < 3.5.1 - Server-Side Request Forgery via XMLRPC Pingback
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-0235.
PoCs published by Thomas McCarthy, including Metasploit module auxiliary/scanner/http/wordpress_pingback_access.
AI-analyzed exploit summary This Metasploit module scans WordPress sites for enabled Pingback APIs, which can be abused to perform port scanning via the XML-RPC interface. It checks for the presence of the X-Pingback header and verifies if the Pingback functionality is active.
Description
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Exploits (1)
This Metasploit module scans WordPress sites for enabled Pingback APIs, which can be abused to perform port scanning via the XML-RPC interface. It checks for the presence of the X-Pingback header and verifies if the Pingback functionality is active.