During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed.

To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-statistics/v2/.... The problem is I must send correct _wpnonce along with my request.

I found a cool explanation here: https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042

They recommend to extract the _wpnonce value from the legitimate URLs from the website page source. But I don't see similar URLs anywhere. My guess is that the plugin installed but not correctly used so it doesn't create these links within the pages.

As I understand, this plugin uses wp_rest action for nonce and it means that the nonce used is global for the whole JSON REST API. Am I correct here? And if yes, how can I obtain this nonce value manually?


You must log in to answer this question.

Browse other questions tagged .