Beyond the Blog: Exploiting WordPress CVEs on HTB 'MetaTwo'

Write-up for ‘MetaTwo’, a box that involves exploiting WordPress CVEs with multiple vectors (SQLi, XXE, LFI) for foothold, and then leveraging passpie for root privilege escalation.

November 30, 2025 · 3 min · 634 words