Unauthenticated Arbitrary File Upload RCE in WordPress MailPoet Newsletters

Repository is a small Python exploit tool for CVE-2014-4725 affecting the WordPress MailPoet/Wysija Newsletters plugin. Structure: (1) README.md documents scan and exploit modes; (2) exploit.py is the main entry point implementing target fingerprinting, vulnerability checking, and ZIP payload upload; (3) pwdnx/exploited.php is a minimal placeholder file (contains only 'Pwdnx1337') and is not directly referenced by the Python code; (4) .gitignore is standard. Core behavior in exploit.py: - Scan mode (--scan targets.txt): For each host (expected without scheme), it requests http://{site}/ to confirm WordPress by keyword matching, then requests http://{site}/wp-admin/admin-post.php?page=wysija_campaigns&action=themes and flags as vulnerable if the response contains 'themeupload'. Vulnerable hosts are saved to vuln.txt. - Exploit mode (--exploit vuln.txt --payload <zip>): Performs a multipart POST to the same admin-post.php endpoint with form fields action=themeupload, submitter=upload, overwriteexistingtheme=on, page=gzneflozab and file field 'my-theme' containing the provided ZIP. If the response contains 'reload=1', it assumes a webshell is now available at /wp-content/uploads/wysija/themes/rock/vuln.php and appends that URL to shell.txt. Concurrency: uses ThreadPoolExecutor with max_threads=15 for both scanning and exploitation. Notable limitations/assumptions: hardcoded HTTP (no HTTPS), hardcoded shell path and theme directory ('rock/vuln.php'), simplistic success check ('reload=1'), and no robust verification that the uploaded payload is actually reachable.

This repository contains a single Metasploit module targeting a vulnerability (CVE-2014-4725) in the WordPress MailPoet Newsletters (wysija-newsletters) plugin prior to version 2.6.8. The exploit leverages an unauthenticated file upload flaw in the plugin's theme upload functionality, allowing an attacker to upload a ZIP file containing a malicious PHP payload disguised as a WordPress theme. The module constructs the ZIP file, uploads it via a crafted POST request to the vulnerable endpoint, and then executes the payload by accessing the uploaded PHP file. The exploit does not require authentication and results in remote code execution on the target server. The code is written in Ruby and is structured as a standard Metasploit module, making use of Metasploit's HTTP and file dropper mixins. The main entry point is the 'exploit' method, which handles the upload and execution of the payload. The module is operational and provides a working exploit for vulnerable targets.