# Web Application Security Assessment: elitery.com
**Date:** 2026-06-21  
**Scope:** Website only (elitery.com)

---

## CMS Fingerprint

| Field | Value |
|---|---|
| **CMS** | WordPress |
| **Theme** | Astra v4.12.6 |
| **Page Builder** | Elementor (Free + Pro) |
| **SEO** | Yoast SEO v27.8 |
| **Plugins** | Jet Engine, Jet Blog, Jet Tabs, Smart Slider 3, Ultimate Elementor, Essential Addons, WF Cookie Consent, WP WhatsApp Chat |
| **Hosting** | Cloudflare WAF (Enterprise-level config) |
| **Origin Server** | Apache 2.4.41 (Ubuntu) @ 43.230.29.247 |
| **Published** | 2021-07-29 | 
| **Last Modified** | 2026-06-19 |

---

## 🔴 Web Vulnerabilities Found

### W-01: Origin Server SSL Certificate Expired
**CVSS:** 5.3 (Medium)  
**Affected:** `43.230.29.247:443`  
**Detail:** SSL certificate expired **16 March 2025** — over 1 year ago.
```
notBefore=Feb 13 07:35:47 2024 GMT
notAfter=Mar 16 07:35:46 2025 GMT ← EXPIRED
```
**Risk:** Users see SSL warning, MITM potential, trust erosion

### W-02: WordPress Readme.html Exposed
**CVSS:** 3.1 (Low)  
**Affected:** `https://elitery.com/readme.html`  
**Detail:** WordPress readme file accessible, leaks WordPress version.
```
HTTP 200 — README file accessible
```
**Risk:** Version disclosure → known CVE targeting

### W-03: XML-RPC Fully Active (Origin Server)
**CVSS:** 7.5 (High)  
**Affected:** `https://43.230.29.247/xmlrpc.php` 
**Detail:** 80 XML-RPC methods exposed:
- `system.listMethods` — method enumeration
- `pingback.ping` — DDoS amplification potential
- `system.multicall` — batch execution
- `wp.getPosts`, `wp.getComments`, etc.

**Note:** Blocked via Cloudflare but **accessible directly on origin IP**

### W-04: Author Enumeration Possible
**CVSS:** 3.7 (Low)  
**Affected:** `https://elitery.com/?author=1` → 301 (exists)  
**Detail:** User enumeration via author parameter. At least 1 author exists.

---

## 🟢 Security Headers (Good)

| Header | Value | Status |
|---|---|---|
| `Strict-Transport-Security` | max-age=31536000; includeSubDomains | ✅ Good |
| `X-Frame-Options` | SAMEORIGIN | ✅ Good |
| `X-Content-Type-Options` | nosniff | ✅ Good |
| `X-XSS-Protection` | 1; mode=block | ✅ Good |
| `Referrer-Policy` | same-origin | ✅ Good |
| `Permissions-Policy` | Restricted (all disabled) | ✅ Good |
| `Content-Security-Policy` | Via Cloudflare Challenge | ✅ Good |
| `X-Permitted-Cross-Domain-Policies` | none | ✅ Good |

---

## 🟡 Additional Observations

| Check | Result | Note |
|---|---|---|
| **Cloudflare WAF** | ✅ Active | Blocks wp-json, wp-admin, OPTIONS |
| **robots.txt** | 200 — Accessible | Standard WordPress |
| **wp-cron.php** | 403 — Blocked | ✅ Good |
| **wp-json/oembed** | 403 — Blocked | ✅ Good |
| **admin-ajax.php** | 400 — Exists | Standard |
| **WP-Cron** | Not exposed | ✅ Internal scheduling |
| **Yoast Version** | v27.8 (latest) | ✅ No known vulns |
| **Astra Version** | v4.12.6 (latest) | ✅ No known vulns |
| **Elementor** | Active | Risk: Pro version may have older vulns |
| **Login Page** | Via Cloudflare Challenge | ✅ Protected |
| **User Registration** | Disabled | ✅ No open registration |
| **REST API** | Blocked by CF | ✅ Protected |

---

## 🔥 Risk Summary — Website Only

| Risk | Count | Detail |
|---|---|---|
| 🔴 **Critical** | 0 | — |
| 🟠 **High** | 1 | XML-RPC via origin (80 methods) |
| 🟡 **Medium** | 1 | SSL expired >1 year |
| 🟢 **Low** | 2 | Readme.html, Author enum |

**Cloudflare WAF protects most attack vectors.** The real risk is the origin server behind it.

### Attack Vector (Website)
```
Main website (elitery.com)
  ├── Cloudflare WAF ✅ — Most attacks blocked
  └── Origin Server (43.230.29.247)
       ├── SSL expired ⚠️
       ├── XML-RPC 80 methods 🟠
       └── Apache 2.4.41 (70+ CVEs) 🟠
```

**To exploit the website specifically:** bypass Cloudflare (origin IP already known) → attack WordPress/Apache directly.