I updated this blog which ran an antiquated version of WordPress from the neolithic era. I used the opportunity to review all the files, all the permissions, everything. It was all squeaky clean. The minute I run a “new and secure” version this happens:
My mistake was updating from an tried and true version which had stood the test of time, to the latest and greatest which happened to be vulnerable to https://github.com/0xsha/wp2shell. Thankfully, the update came with containerization, which isolated it from whatever else my solar Pi is running. Maybe pointing to wordpress:latest wasn’t a good idea, but then again, this vulnerability has been around for a while so I was fucked no matter what. It’s kind of crazy to find something so blatant in WordPress core. WordPress is notorious for having vulnerable plugins, I had gotten to trust WordPress itself. No longer.
I’ve restricted routing rules to the blog, and added monitoring to detect admin users getting added.
Leave a Comment