{
  "id": 2814368,
  "title": "BrunnerCTF : WordPressed to Root Writeup",
  "url": "https://urgent.news/2026/08/23/brunnerctf-wordpressed-to-root-writeup",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T15:20:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/exploitnotes/brunnerctf-wordpressed-to-root-writeup-3o62"
  },
  "original_language": "en",
  "account": "The Dockerfile for this challenge sets the base image to wordpress:7.0.0-php8.2-apache, which was then pinned with a specific SHA256 hash. Additionally, the runtime image includes gcc and libc6-dev packages, suggesting that the intended privilege escalation method involves compiling a local exploit on the compromised system. The Docker compose file exposes the default MariaDB credentials - wordpress, wordpress, and rootpassword - which can be used for further exploitation. During the initial access, a deliberate vulnerable plugin named wp2shell was used to exploit two remote code execution vulnerabilities in WordPress 7.0.0. The first vulnerability (CVE-2026-63030) is a blind SQL injection in the REST batch route, allowing an attacker to bypass authentication and execute arbitrary SQL commands. The second vulnerability (CVE-2026-60137) enables an attacker to fetch user credentials from the database, which can then be used to log in as the admin user and upload a webshell, resulting in a working reverse shell as the www-data user. The box was hardened against typical container escape and SUID tricks, making the exploitation path reliant on a local privilege escalation via a recent CVE in sudo.",
  "summary": "Overview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes through a deliberately vulnerable plugin ( wp2shell ) that hands over a www-data shell. Privilege escalation is the real puzzle: the box is hardened against the usual container-escape and SUID tricks,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}