Loading vulnerability…
CVE-2025-32583 is a code injection vulnerability in the termel PDF 2 Post product affecting versions through 2.4.0. The available description states that the issue is an Improper Control of Generation of Code ('Code Injection') vulnerability that allows Remote Code Inclusion. Based on the provided information, the flaw permits attacker-controlled code or remotely supplied code to be included and executed by the vulnerable application. Specific vulnerable functions, parameters, or code paths are not provided in the available content.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working exploit for CVE-2025-32583, a critical authenticated remote code execution vulnerability in the WordPress PDF 2 Post plugin (versions <= 2.4.0). The main script, 'CVE-2025-32583.py', is a Python tool that automates the exploitation process: it logs into a target WordPress site using provided credentials, retrieves a required nonce from the plugin's upload page, generates a malicious ZIP file containing a PHP webshell, and uploads it via the vulnerable plugin endpoint. Upon successful exploitation, the shell is accessible in the WordPress uploads directory, organized by year and month. The payload is a simple PHP webshell that allows arbitrary command execution via HTTP requests. The repository also includes a README.md with detailed usage instructions and a requirements.txt listing dependencies. The exploit requires valid WordPress credentials and a vulnerable plugin configuration, and is operational with a hardcoded, basic payload.
This repository contains a working exploit for CVE-2025-32583, a critical authenticated remote code execution vulnerability in the WordPress PDF 2 Post plugin (versions <= 2.4.0). The main script, 'CVE-2025-32583.py', is a Python tool that automates the exploitation process: it logs into a target WordPress site using provided credentials, retrieves a CSRF nonce from the plugin's upload page, generates a malicious ZIP file containing a PHP webshell, and uploads it via the vulnerable plugin endpoint. Upon successful exploitation, the PHP shell is accessible in the WordPress uploads directory, allowing arbitrary command execution via HTTP requests. The repository also includes a README with detailed usage instructions, a requirements.txt for dependencies, and a license file. The exploit requires valid WordPress credentials (even low-privilege) and targets a specific plugin endpoint. The payload is a simple PHP webshell that executes commands passed via the 'cmd' parameter.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.