# OneLogin authentication bypass on WordPress sites via XMLRPC

OneLogin WordPress plugin created users with default password '@@@nopass@@@' but left XMLRPC enabled, letting attackers authenticate as any SSO user and create posts/pages/upload files.

- Payout: $7,000
- Severity: high
- Program: Uber
- Credited: jouko
- Disclosed: 2016-07-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/138869
- Library page: https://bugbountylibrary.com/r/h1%3A138869
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:legacy-endpoint vuln:access-control vuln:auth-bypass

**Target:** WordPress XMLRPC endpoint (xmlrpc.php) with OneLogin SSO plugin
**Root cause:** OneLogin plugin provisions WordPress users with a hardcoded default password '@@@nopass@@@' and only blocks wp-login.php, leaving XMLRPC authentication against the internal user DB intact.
**Steps:**
1. Identify WordPress sites using OneLogin SSO (e.g. love.uber.com, newsroom.uber.com)
2. Guess/obtain a valid username (e.g. cbarry@uber.com)
3. POST XML to `/xmlrpc.php` calling `wp.getOptions` with username and password `@@@nopass@@@` to confirm auth
4. Call `wp.newPost` with same creds to create draft/private posts containing HTML/JS
5. Call `metaWeblog.newMediaObject` to upload files (e.g. `.key`, potentially `.html`/`.swf`) to `/wp-content/uploads/`
**How found:** Noticed the OneLogin plugin blocks wp-login.php but not XMLRPC, then hypothesized the internal user DB still holds provisioned accounts with the plugin's default password and tested XMLRPC auth against known @uber.com usernames.
**Exploitation:** Attacker authenticates to xmlrpc.php using any SSO-provisioned username and the static password '@@@nopass@@@', then invokes XMLRPC methods (wp.newPost, metaWeblog.newMediaObject, wp.setOptions) to create content, upload files, and potentially modify options — enabling stored XSS against admins or RCE if uploaded file types are executed.
**Escalation:** Private/draft posts containing JS target administrators for stored XSS; uploaded files could yield RCE if server executes allowed extensions; non-readonly options via wp.setOptions may be mutable.
**Insight:** When an SSO plugin disables one auth surface (wp-login.php), enumerate other WordPress auth entry points — xmlrpc.php, REST API, wp-login.php?normal=1 — and check whether provisioned users carry a static default password.