CVE-2013-2010
CRITICALW3 Total Cache < 0.9.2.8 - Remote PHP Code Execution
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-2010.
PoCs published by Metasploit, spyata123, Unknown, juan vazquez, hdm, Christian Mehlmauer, including Metasploit module exploits/unix/webapp/wp_total_cache_exec.
AI-analyzed exploit summary This Metasploit module exploits a PHP code injection vulnerability in WordPress W3 Total Cache (up to 0.9.2.8) by injecting malicious code via comment macros. It supports both authenticated and unauthenticated exploitation, with options for brute-forcing post IDs.
Description
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
Exploits (3)
This Metasploit module exploits a PHP code injection vulnerability in WordPress W3 Total Cache (up to 0.9.2.8) by injecting malicious code via comment macros. It supports both authenticated and unauthenticated exploitation, with options for brute-forcing post IDs.
This is a Python-based exploit for CVE-2013-2010, targeting a Remote Code Execution (RCE) vulnerability in the W3 Total Cache WordPress plugin. The exploit sends a malicious payload via a crafted comment to execute arbitrary PHP code.
This Metasploit module exploits a PHP code injection vulnerability in WordPress W3 Total Cache (up to 0.9.2.8) via malicious comment injection using the 'mfunc' macro. It supports authenticated and unauthenticated exploitation, with options for brute-forcing post IDs.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H