Wordpress wp-cron.php DOS

ID: wordpress-wp-cron

Severity: info

Author: pathtaga

Tags: wordpress,cron,wp,dos

Description

When this file is accessed a heavy MySQL query is performed, so it could be used by attackers to cause a DoS.

YAML Source

id: wordpress-wp-cron

info:
  name: Wordpress wp-cron.php DOS
  author: pathtaga
  severity: info
  description: When this file is accessed a heavy MySQL query is performed, so it could be used by attackers to cause a DoS.
  reference:
    - https://book.hacktricks.xyz/pentesting/pentesting-web/wordpress
    - https://medium.com/@thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30
  metadata:
    max-request: 2
  tags: wordpress,cron,wp,dos

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/wp-cron.php"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - (regex("<link[^>]+s\d+\.wp\.com",body_1))
          - (regex("<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -",body_1))
          - (regex("<!--[^>]+WP-Super-Cache",body_1))
          - contains(body_1, "/wp-content/themes/")
          - contains(body_1, "/wp-includes/")
          - contains(body_1, 'name=\"generator\" content=\"wordpress')
          - contains(body_1, '<!-- performance optimized by w3 total cache.')
        condition: or

      - type: dsl
        dsl:
          - "len(body_2) == 0"
          - "status_code_2 == 200"
          - "contains(content_type_2, 'text/html')"
        condition: and
# digest: 490a004630440220021c786101a130f6a70bda3cf301103fc497181117fe9b93fc7bb15a6c5e9fdc0220418af9578192e093e901cce85b1531fdcaf6f25c471ed9e10e75431a35dd3ace:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wordpress-wp-cron.yaml"

View on Github