Vulnerable Wordpress Docker - Created at VTF by Waleed Zafar

Usage

1. Clone git repository:

 git clone https://github.com/waleedzafar68/vulnerablewp/

2. Navigate to the cloned foder

cd vulnerablewp

3. Run the install.sh file:

./install.sh

Note: Permission issue: Run the following if you encounter permissions issue

chmod +x install.sh

4. Navigate to localhost:

http://127.0.0.1

5. Install Wordpress after choosing language

   

6. Set the site title, Username, password and email

   

7. Navigate to plugins at http://localhost/wp-admin/plugins.php. Login if need be.

8. Scroll down and activate any plugin except Hello Dolly and Akismet. Example attached

   

9. See it is activated.

   

10. Repeat the process for the next three plugins.

11. All activated.

    

Vulnerable Plugins:

Mail Masta v1.0 (CVE-2017-6095-6098, CVE-2017-6570-6570)

Duplicator v1.2.32 (CVE-2018-7543, CVE-2018-17207, CVE-2020-11738)

ReFlex Gallery v3.1.7 (CVE-2015-4133)

WP Google Maps v3.4 (CVE-2019-10692)