Thread by @fs0c131y

<Thread> As the problem has been fixed, I can disclose the security issue I found in one of the Vatican app.

The app "El Camino del Corazón" is just a webview for a website called caminodelcorazon.church

1/

https://twitter.com/fs0c131y/status/1184564534348075011

I opened the app and saw in the network requests that caminodelcorazon.church was based in @wordpress.

Thanks to @_WPScan_ I quickly scanned the website and... oopsie the registration on their website was enabled: caminodelcorazon.church/web/wp-login.p…

2/

So I entered my username and my email to create a new profile

3/

I received an email to confirm my profile

4/

I used the password they gave me to login and...

💥BOOM 💥

*hacker voice* I'm in the Vatican's website

5/

Worth to say, 5 minutes later they disabled the registration and deleted my account

6/

@TheTweetOfGod are we ok? It's too hot where @s8n live

@TheTweetOfGod @s8n PS: They deleted my profile after 5 minutes so it's complicate to estimate what I was able to do. I don't think my profile was admin, otherwise I would have had more items on the left column

@TheTweetOfGod @s8n PS1: Wordpress has 6 predefined roles. By looking at the screenshot I think, not sure, I was a subscriber. So the severity in low but still the story is funny as hell 🤣 wordpress.org/support/articl…