Unauthenticated Local File Inclusion in Madara WordPress Theme

This repository is a small standalone Python exploit for CVE-2025-4524, described as a local file inclusion issue affecting the WordPress Madara Theme before version 2.2.2.1. The repository contains only two files: a minimal README and a single executable script, WPMadara.py, which is the full exploit implementation. The script is designed for bulk scanning and exploitation of multiple targets. It prompts the operator for a thread count and a target list file, normalizes each target by stripping any supplied scheme, then tries both HTTPS and HTTP connectivity. For each reachable host, it sends a POST request to the WordPress AJAX endpoint /wp-admin/admin-ajax.php using the action madara_load_more. The key exploit primitive is the template parameter, which is set to a deep traversal path resolving to /etc/passwd. Additional vars[*] parameters are included to resemble expected application input. Successful exploitation is determined by checking whether the response contains the string root:x:0:0, indicating that /etc/passwd was returned. Vulnerable targets are printed and appended to vuln.txt. The code uses multithreading via Queue and threading.Thread, disables TLS verification warnings, and randomizes User-Agent headers in a basic attempt to reduce blocking or filtering. There is no advanced post-exploitation, shell payload, authentication bypass chain, or arbitrary command execution; the capability is limited to unauthenticated file-read verification through LFI. Structurally, the script includes: banner/UI functions, configuration input handling, session creation with randomized headers, a result writer, the core exploit function, worker-thread logic for protocol fallback and target processing, and a main block that loads targets from a file and launches the scan. Overall, this is an operational bulk LFI checker/exploit rather than a mere detector, because it actively attempts to retrieve a sensitive local file from each target.

This repository is a small standalone Python exploit for CVE-2025-4524, described as a local file inclusion vulnerability in the WordPress Madara Theme before 2.2.2.1. The repository contains only two files: a minimal README and a single executable script, WPMadara.py. The script is a multithreaded mass-checker/exploit. It reads a user-supplied target list, normalizes each entry to remove any scheme, then tries both HTTPS and HTTP connectivity for each host. For reachable targets, it sends a POST request to the WordPress AJAX endpoint /wp-admin/admin-ajax.php using the action madara_load_more and a directory traversal payload in the template parameter pointing to /etc/passwd. A successful exploit is determined by the presence of the string root:x:0:0 in the response body. Core capabilities: - Bulk scanning of many targets from a file. - Automatic HTTP/HTTPS selection per target. - Use of multiple threads for faster exploitation attempts. - Basic request header randomization via a small User-Agent list. - Writes confirmed vulnerable targets to vuln.txt. Repository structure and code flow: - README.md: brief vulnerability label and image link. - WPMadara.py: - configure(): prompts for thread count and target file. - normalize_base(): strips schemes and trailing slashes from targets. - banner()/Madara(): cosmetic terminal banner output. - create_stealth_session(): creates a requests session with SSL verification disabled and randomized User-Agent headers. - save_result(): appends findings to vuln.txt. - exploit_madara_lfi(): sends the actual exploit POST request and checks for /etc/passwd disclosure. - worker_logic(): per-thread worker that tests connectivity and launches exploitation. - core_engine(): queues targets and starts worker threads. - main block: loads targets from file and runs the scan. This is a real exploit rather than a pure detector because it actively attempts file disclosure using a concrete traversal payload. However, its payload is fixed to reading /etc/passwd and does not provide post-exploitation or arbitrary payload customization, so OPERATIONAL is the best fit.

This repository contains a proof-of-concept exploit for CVE-2025-4524, a Local File Inclusion (LFI) and potential Remote Code Execution (RCE) vulnerability in the madara-core WordPress theme. The exploit leverages the 'madara_load_more' AJAX action, which unsafely includes user-supplied file paths via the 'template' parameter. The repository consists of a README.md explaining the vulnerability and exploitation scenarios, and a Python script (poc.py) that automates the attack. The script supports three main actions: reading arbitrary files (LFI), uploading a PHP webshell via a crafted image (for RCE), and executing arbitrary commands through the webshell. The attack is unauthenticated and targets the /wp-admin/admin-ajax.php endpoint. The exploit is operational, providing both file disclosure and code execution capabilities, depending on the configuration of the target WordPress instance.