BrunnerCTF Boot2Root Challenge Uses Real CVEs for WordPress-to-Root Exploit Path

A capture-the-flag challenge called 'WordPressed to Root' tasks participants with compromising a Dockerized WordPress 7.0.0 installation running on PHP 8.2 and Apache atop Debian Trixie. Initial access is gained by exploiting a deliberately vulnerable plugin called wp2shell, which leverages a public proof-of-concept chaining two CVEs for unauthenticated SQL injection and remote code execution. Once inside as www-data, players must escalate privileges using a recent CVE in sudo itself, with gcc and libc6-dev pre-installed on the image to hint that compiling a local exploit on the box is the intended approach. A misconfiguration in the entrypoint script exposes randomly generated WordPress admin credentials to all child processes, including Apache and PHP workers, providing a secondary avenue for credential harvesting. Standard container-escape and SUID techniques are intentionally blocked, steering solvers toward the sudo vulnerability as the sole privilege escalation path.