Proof of Concept for CVE-2021-38314 (Redux Framework)

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

In order to understand this bug I first read through the Wordfence blog post and then read through through the Redux Framework source code to fill in the gaps. I also installed Wordpress with this plugin so that I didn’t have to test things blindly. The relevant code is in inc/class.redux_instances.php . The first hook I looked at is this one: $hash = md5 ( trailingslashit ( network_site_url…

Read on /posts/redux_wordpress/ ↗