Dear wp-super-cache\/w3-total-cache developers,<\/p>\n
As you may be aware worpress allows some html in comments including html comments. With wp-super-cache or w3-total-cache installed php code, by design, is allowed in comments too. Not to mention a relatively harmless XSS bug (or feature, depends on who you ask) is elevated into server side code execution.<\/p>\n
The following examples work with wp-super-cache and w3-total-cache, all you need to do is post a comment with: – php shell\/backdoor upload: I suggest you remove the mfunc\/mclude features entirely, it’s way too hazardous to parse and execute the output.<\/p>\n Regards, PS. [ Just plain deleted ]<\/em><\/p>\n https:\/\/wordpress.org\/extend\/plugins\/wp-super-cache\/<\/p>\n","protected":false},"template":"","class_list":["post-3585416","topic","type-topic","status-closed","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/3585416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/3585416\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=3585416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n – to display time and date:
\n<!--mfunc eval(base64_decode( redacted )); --><!--\/mfunc--><\/code><\/p>\n
\n<!--mfunc eval(base64_decode( also redacted, see a trend here ;) )); --><!--\/mfunc--><\/code>
\nthe shell will eval($_POST[“e”]) and can be accessed at: http:\/\/path\/to\/blog\/wp-content\/redacted<\/p>\n
\nCsaba<\/p>\n
\nBelow you’ll find the same proof of concept examples escaped with base64:<\/p>\n