BrunnerCTF : WordPressed to Root Writeup
Overview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes through a deliberately vulnerable plugin ( wp2shell ) that hands over a www-data shell. Privilege escalation is the real puzzle: the box is hardened against the usual container-escape and SUID tricks,…
The Dockerfile for this challenge sets the base image to wordpress:7.0.0-php8.2-apache, which was then pinned with a specific SHA256 hash. Additionally, the runtime image includes gcc and libc6-dev packages, suggesting that the intended privilege escalation method involves compiling a local exploit on the compromised system. The Docker compose file exposes the default MariaDB credentials - wordpress, wordpress, and rootpassword - which can be used for further exploitation.
During the initial access, a deliberate vulnerable plugin named wp2shell was used to exploit two remote code execution vulnerabilities in WordPress 7.0.0. The first vulnerability (CVE-2026-63030) is a blind SQL injection in the REST batch route, allowing an attacker to bypass authentication and execute arbitrary SQL commands. The second vulnerability (CVE-2026-60137) enables an attacker to fetch user credentials from the database, which can then be used to log in as the admin user and upload a webshell, resulting in a working reverse shell as the www-data user.
The box was hardened against typical container escape and SUID tricks, making the exploitation path reliant on a local privilege escalation via a recent CVE in sudo.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
