CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit

An automated exploit and scanner for CVE-2025-34085, a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities.

---

📄 CVE Summary

• CVE ID: CVE-2025-34085
• Affected Component: WordPress Plugin — Simple File List
• Vulnerability Type: Unauthenticated File Upload & File Rename to Executable
• Impact: Remote Code Execution (RCE)
• Exploit Author: 0xgh057r3c0n
• Access Vector: Remote, unauthenticated

---

⚙️ Exploit Workflow

1. Unauthenticated File Upload

   • Uploads a malicious file to:
     /wp-content/plugins/simple-file-list/ee-upload-engine.php

2. Rename to PHP Extension

   • Renames the uploaded file to a .php or similar extension via:
     /wp-content/plugins/simple-file-list/ee-file-engine.php

3. Execute Payload

   • Executes arbitrary commands by accessing the renamed web shell.

---

🚀 Usage

📌 Single Target

python3 CVE-2025-34085.py -u http://target.com --cmd "id"

📄 Multiple Targets

Put target URLs in targets.txt (one per line), then run:

python3 CVE-2025-34085.py --cmd "whoami"

---

🔧 Command-Line Options

Argument	Description
-u	Target URL (e.g., http://example.com)
--cmd	Command to execute on the remote shell (default: id)
--inline	Use inline payload (no ?cmd= parameter)

---

✅ Sample Output

[+] http://target.com | http://target.com/wp-content/uploads/simple-file-list/shell.php
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Successful targets are saved to vuln.txt.

---

📁 Files

• CVE-2025-34085.py — Main exploit script
• targets.txt — (Optional) List of target domains
• vuln.txt — Log of successful exploits

---

🛡️ Mitigation

Administrators should:

• Update the plugin to its latest secure version.
• Restrict public access to upload and rename endpoints.
• Monitor uploaded content for unexpected PHP files.
• Deploy a WAF or endpoint protection system.

---

📘 Disclaimer

This project is intended for educational and authorized testing purposes only. The author bears no responsibility for misuse or damage caused by this tool.

---

📄 License

This project is licensed under the MIT License. 📄 View Full License Text

---

👨‍💻 Author

0xgh057r3c0n 🔗 GitHub: github.com/0xgh057r3c0n

---