Question

During a web application assessment, you discover a WordPress site running a 'Media Manager Pro' plugin that allows authenticated contributors to upload files. The upload validation only checks the Content-Type header sent by the browser and the file extension against a blocklist that includes .php and .phtml. You have valid contributor credentials. Which technique is MOST likely to result in remote code execution?

Accepted Answer

Upload a file named shell.php5 (or shell.pHP) with a spoofed image/jpeg Content-Type header, then request the uploaded file to trigger PHP execution

Answer

Submit a reflected XSS payload in the file's description field to steal the administrator's session cookie

Answer

Use SQL injection in the upload metadata form to dump the wp_users table and crack the admin password hash

Answer

Perform a brute-force attack against wp-login.php to escalate the contributor account to an administrator role