# WordPress PrivEsc

## Exploit

{% embed url="<https://www.exploit-db.com/exploits/44595>" %}

## How to Escalate Privileges

### Login as a normal user

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M7Ax-Dir6BPF0RQvKC5%2F-M7Ayf1o25cZBtbxG6ND%2Fimage.png?alt=media\&token=2f2cae90-491c-4949-9420-18d8f4f39af4)

### Go to Profile

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M7Ax-Dir6BPF0RQvKC5%2F-M7AzE5G24pJBXZ4U0sQ%2Fimage.png?alt=media\&token=4d5ed3bc-2232-4620-86cf-5d73451b1198)

### Update Profile&#x20;

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M7Ax-Dir6BPF0RQvKC5%2F-M7AzOM9J07XsJAHHrZp%2Fimage.png?alt=media\&token=6febb366-b3c8-4ef4-8368-9ad2295911a1)

### Intercept with BURP

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M7Ax-Dir6BPF0RQvKC5%2F-M7AxBGgPHVqZJEiHbYp%2Fimage.png?alt=media\&token=257b1c7a-c726-4f3a-b2c9-ee00b2e6fce2)

Add the following to the **REQUEST**

```
&ure_other_roles=administrator&
```

Example below:

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M7Ax-Dir6BPF0RQvKC5%2F-M7AxRLbEHa37ndgCRVn%2Fimage.png?alt=media\&token=71423629-c731-4a11-a737-56ee49475728)

### Results

![](https://3391461163-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M-SeUOaaky_0dmtDTFu%2F-M78X7wZdvey2HkCs-qi%2F-M7AvnvVfunhG9nASfix%2Fimage.png?alt=media\&token=00742602-a689-435f-8f55-c3eb48c86ab7)
