{"vulnerability": "CVE-2021-24947", "sightings": [{"uuid": "f567d8d4-0dea-4cf4-a4fe-4c3c0f5814b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24947.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "9359e2be-3296-4978-9423-8c38963d2536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/cibsecurity/36953", "content": "\u203c CVE-2021-24947 \u203c\n\nThe RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-07T18:35:10.000000Z"}, {"uuid": "6a84338b-6a6a-4471-8c23-69e43b6d28ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/57185", "content": "Kali Linux Tutorials\nWpgarlic : A Proof-Of-Concept WordPress Plugin Fuzzer\n\nWpgarlic is a proof-of-concept WordPress plugin fuzzer used in the research described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html\u00a0that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.\n\nIf you want to continue the research, start with less popular plugins \u2013 if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered \u2013 but fewer ones.\n\nFuzzer reports contain a lot of false positives \u2013 most of them don\u2019t indicate a vulnerability. After seeing a report, first analyze whether the behavior you\u2019re observing is indeed a vulnerability or a false positive. Don\u2019t spam WPScan/vendors with raw fuzzer reports \u2013 provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet\u2019s assume you are fuzzing responsive-vector-mapsin version 6.4.0:\n\n./bin/fuzz_plugin responsive-vector-maps \u2013version 6.4.0\n\n(to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call:\n\n./bin/print_findings data/plugin_fuzz_results/\n\nThat means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server:\u00a0CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet\u2019s assume you are fuzzing page-builder-addin version 1.4.9.4:\n\n./bin/fuzz_plugin page-builder-add \u2013version 1.4.9.4\n\nOption update leading to stored XSS\n\n./bin/fuzz_plugin duplicate-page-or-post \u2013version 1.4.6 False positivesUnfortunately, for most of the plugins the fuzzer doesn\u2019t find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:\n\nCall: wp_mail arguments={\u2018to\u2019: \u2018plugin@pluginvendor.com\u2019, \u2018subject\u2019: \u2018[Plugin contact] \u2013 http://GARLICGARLICGARLIC.example.com\u2019}\n\nThis can mean, that wp_mailis indeed called, but you don\u2019t control the recipient and most of the subject. If you want to be sure, look at the plugin source. Additional tips for reading fuzzer reports* If you see the message; May as well be equal: \u2026 and \u2026\u00a0\u2013 that means that the mechanism to pretend that a known payload is equal to any other string (described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.\n* If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__\u2013 that means that an uploaded file access was detected. No further checks are currently made \u2013 to check whether this is a vulnerability, look at the code.\n* Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world: for example, you can\u2019t inject anything into $_GET['page']if you want a particular menu page to be displayed. Usage cheatsheetThe first run of fuzzing or of the test[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:36.186538Z"}, {"uuid": "f0cc67d9-9b99-4090-a0ca-db46ba28e11e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.150108Z"}, {"uuid": "d9770898-6130-4a47-8932-2c082094105d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/51195", "content": ".  That means that the fuzzer detected executing fopen() on a known payload.  Most of the payloads contain the word GARLIC in them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.  Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markers  endpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947 (https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18).  What you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).  The data in yellow are what payloads were injected into what variables.  Reflected XSS  Let's assume you are fuzzing page-builder-add in version 1.4.9.4:  ./bin/fuzz_plugin page-builder-add --version 1.4.9.4    After printing the results, you will see known payload echoed back:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.279287Z"}, {"uuid": "478bd411-2a83-4905-bd75-8465c30404f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/57185", "content": "Kali Linux Tutorials\nWpgarlic : A Proof-Of-Concept WordPress Plugin Fuzzer\n\nWpgarlic is a proof-of-concept WordPress plugin fuzzer used in the research described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html\u00a0that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.\n\nIf you want to continue the research, start with less popular plugins \u2013 if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered \u2013 but fewer ones.\n\nFuzzer reports contain a lot of false positives \u2013 most of them don\u2019t indicate a vulnerability. After seeing a report, first analyze whether the behavior you\u2019re observing is indeed a vulnerability or a false positive. Don\u2019t spam WPScan/vendors with raw fuzzer reports \u2013 provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet\u2019s assume you are fuzzing responsive-vector-mapsin version 6.4.0:\n\n./bin/fuzz_plugin responsive-vector-maps \u2013version 6.4.0\n\n(to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call:\n\n./bin/print_findings data/plugin_fuzz_results/\n\nThat means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server:\u00a0CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet\u2019s assume you are fuzzing page-builder-addin version 1.4.9.4:\n\n./bin/fuzz_plugin page-builder-add \u2013version 1.4.9.4\n\nOption update leading to stored XSS\n\n./bin/fuzz_plugin duplicate-page-or-post \u2013version 1.4.6 False positivesUnfortunately, for most of the plugins the fuzzer doesn\u2019t find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:\n\nCall: wp_mail arguments={\u2018to\u2019: \u2018plugin@pluginvendor.com\u2019, \u2018subject\u2019: \u2018[Plugin contact] \u2013 http://GARLICGARLICGARLIC.example.com\u2019}\n\nThis can mean, that wp_mailis indeed called, but you don\u2019t control the recipient and most of the subject. If you want to be sure, look at the plugin source. Additional tips for reading fuzzer reports* If you see the message; May as well be equal: \u2026 and \u2026\u00a0\u2013 that means that the mechanism to pretend that a known payload is equal to any other string (described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.\n* If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__\u2013 that means that an uploaded file access was detected. No further checks are currently made \u2013 to check whether this is a vulnerability, look at the code.\n* Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world: for example, you can\u2019t inject anything into $_GET['page']if you want a particular menu page to be displayed. Usage cheatsheetThe first run of fuzzing or of the test[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:46.738925Z"}, {"uuid": "5493cd3f-8c8f-4349-a22f-901797968ee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:54.996118Z"}, {"uuid": "f5c652b8-db38-40c8-9c39-b1cb8b768272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "seen", "source": "https://t.me/hacking_Attack/51195", "content": ".  That means that the fuzzer detected executing fopen() on a known payload.  Most of the payloads contain the word GARLIC in them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.  Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markers  endpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947 (https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18).  What you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).  The data in yellow are what payloads were injected into what variables.  Reflected XSS  Let's assume you are fuzzing page-builder-add in version 1.4.9.4:  ./bin/fuzz_plugin page-builder-add --version 1.4.9.4    After printing the results, you will see known payload echoed back:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:55.077665Z"}, {"uuid": "6617b0fa-4166-49d5-b50d-bf8d55c1dccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/57185", "content": "Kali Linux Tutorials\nWpgarlic : A Proof-Of-Concept WordPress Plugin Fuzzer\n\nWpgarlic is a proof-of-concept WordPress plugin fuzzer used in the research described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html\u00a0that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.\n\nIf you want to continue the research, start with less popular plugins \u2013 if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered \u2013 but fewer ones.\n\nFuzzer reports contain a lot of false positives \u2013 most of them don\u2019t indicate a vulnerability. After seeing a report, first analyze whether the behavior you\u2019re observing is indeed a vulnerability or a false positive. Don\u2019t spam WPScan/vendors with raw fuzzer reports \u2013 provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet\u2019s assume you are fuzzing responsive-vector-mapsin version 6.4.0:\n\n./bin/fuzz_plugin responsive-vector-maps \u2013version 6.4.0\n\n(to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call:\n\n./bin/print_findings data/plugin_fuzz_results/\n\nThat means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server:\u00a0CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet\u2019s assume you are fuzzing page-builder-addin version 1.4.9.4:\n\n./bin/fuzz_plugin page-builder-add \u2013version 1.4.9.4\n\nOption update leading to stored XSS\n\n./bin/fuzz_plugin duplicate-page-or-post \u2013version 1.4.6 False positivesUnfortunately, for most of the plugins the fuzzer doesn\u2019t find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:\n\nCall: wp_mail arguments={\u2018to\u2019: \u2018plugin@pluginvendor.com\u2019, \u2018subject\u2019: \u2018[Plugin contact] \u2013 http://GARLICGARLICGARLIC.example.com\u2019}\n\nThis can mean, that wp_mailis indeed called, but you don\u2019t control the recipient and most of the subject. If you want to be sure, look at the plugin source. Additional tips for reading fuzzer reports* If you see the message; May as well be equal: \u2026 and \u2026\u00a0\u2013 that means that the mechanism to pretend that a known payload is equal to any other string (described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.\n* If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__\u2013 that means that an uploaded file access was detected. No further checks are currently made \u2013 to check whether this is a vulnerability, look at the code.\n* Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world: for example, you can\u2019t inject anything into $_GET['page']if you want a particular menu page to be displayed. Usage cheatsheetThe first run of fuzzing or of the test[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T17:00:05.584270Z"}, {"uuid": "2866ae7d-9e59-444d-9334-8e13a994bb9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/51195", "content": ".  That means that the fuzzer detected executing fopen() on a known payload.  Most of the payloads contain the word GARLIC in them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.  Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markers  endpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947 (https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18).  What you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).  The data in yellow are what payloads were injected into what variables.  Reflected XSS  Let's assume you are fuzzing page-builder-add in version 1.4.9.4:  ./bin/fuzz_plugin page-builder-add --version 1.4.9.4    After printing the results, you will see known payload echoed back:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T23:00:04.043467Z"}, {"uuid": "61e8b785-4c1c-4f59-aefe-3e051f5e94cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T23:00:04.103856Z"}, {"uuid": "4247d1e1-1ccb-46fc-8da8-53146cfc48e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:14.089442Z"}, {"uuid": "277acfc5-be96-479a-bdc9-f2096cd09e6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/51195", "content": ".  That means that the fuzzer detected executing fopen() on a known payload.  Most of the payloads contain the word GARLIC in them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.  Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markers  endpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947 (https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18).  What you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).  The data in yellow are what payloads were injected into what variables.  Reflected XSS  Let's assume you are fuzzing page-builder-add in version 1.4.9.4:  ./bin/fuzz_plugin page-builder-add --version 1.4.9.4    After printing the results, you will see known payload echoed back:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:14.038947Z"}, {"uuid": "94698b72-40ac-4573-86dd-66696973e6cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24947", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/57185", "content": "Kali Linux Tutorials\nWpgarlic : A Proof-Of-Concept WordPress Plugin Fuzzer\n\nWpgarlic is a proof-of-concept WordPress plugin fuzzer used in the research described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html\u00a0that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.\n\nIf you want to continue the research, start with less popular plugins \u2013 if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered \u2013 but fewer ones.\n\nFuzzer reports contain a lot of false positives \u2013 most of them don\u2019t indicate a vulnerability. After seeing a report, first analyze whether the behavior you\u2019re observing is indeed a vulnerability or a false positive. Don\u2019t spam WPScan/vendors with raw fuzzer reports \u2013 provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet\u2019s assume you are fuzzing responsive-vector-mapsin version 6.4.0:\n\n./bin/fuzz_plugin responsive-vector-maps \u2013version 6.4.0\n\n(to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call:\n\n./bin/print_findings data/plugin_fuzz_results/\n\nThat means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server:\u00a0CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet\u2019s assume you are fuzzing page-builder-addin version 1.4.9.4:\n\n./bin/fuzz_plugin page-builder-add \u2013version 1.4.9.4\n\nOption update leading to stored XSS\n\n./bin/fuzz_plugin duplicate-page-or-post \u2013version 1.4.6 False positivesUnfortunately, for most of the plugins the fuzzer doesn\u2019t find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:\n\nCall: wp_mail arguments={\u2018to\u2019: \u2018plugin@pluginvendor.com\u2019, \u2018subject\u2019: \u2018[Plugin contact] \u2013 http://GARLICGARLICGARLIC.example.com\u2019}\n\nThis can mean, that wp_mailis indeed called, but you don\u2019t control the recipient and most of the subject. If you want to be sure, look at the plugin source. Additional tips for reading fuzzer reports* If you see the message; May as well be equal: \u2026 and \u2026\u00a0\u2013 that means that the mechanism to pretend that a known payload is equal to any other string (described in\u00a0https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.\n* If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__\u2013 that means that an uploaded file access was detected. No further checks are currently made \u2013 to check whether this is a vulnerability, look at the code.\n* Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world: for example, you can\u2019t inject anything into $_GET['page']if you want a particular menu page to be displayed. Usage cheatsheetThe first run of fuzzing or of the test[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:42.233767Z"}]}