Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
lab-cve-2016-15042 — CVE-2016-15042 lab: Dockerized WordPress PoC for unauthenticated file upload in Frontend File Manager <4.0 and N‑Media Post Front‑end Form <1.1 | Kitploit
Tools/GitHubGitHub/imbios/lab-cve-2016-15042
Vulnerability AnalysisWeb Application ExploitationCTFPenetration TestingLearning & EducationLabs & Practice
GitHubimbios/lab-cve-2016-15042

lab-cve-2016-15042

CVE-2016-15042 lab: Dockerized WordPress PoC for unauthenticated file upload in Frontend File Manager <4.0 and N‑Media Post Front‑end Form <1.1

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2016-15042 – WordPress Frontend File Manager & N‑Media Post Front‑end Form Unauthenticated File Upload (PoC Lab)

Fully reproducible, Dockerized lab to validate and demonstrate CVE-2016-15042:

  • Frontend File Manager (nmedia-user-file-uploader) v3.7 (vulnerable < 4.0)
  • N‑Media Post Front‑end Form (wp-post-frontend) v1.0 (vulnerable < 1.1)

This repo provides a one-command setup, verification steps with Nuclei, and artifacts for reviewers. Keywords: WordPress, CVE-2016-15042, unauthenticated file upload, arbitrary file upload, PoC, security lab, Docker.

Requirements

  • Docker + Docker Compose plugin
  • curl
  • Nuclei (optional, for verification)

Quick start

root@kitploit:~
./scripts/setup.sh

Once finished:

  • WordPress: http://localhost:8090
  • Admin: admin / admin
  • Public user: publicuser / publicpass

Verify the vulnerability with Nuclei (debug enabled)

Option A: Download the template locally into this lab folder and run it.

root@kitploit:~
curl -sL "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/http/cves/2016/CVE-2016-15042.yaml" -o ./CVE-2016-15042.yaml
nuclei -t ./CVE-2016-15042.yaml -u http://localhost:8090 -debug -vv \
  | tee ./debug/CVE-2016-15042-debug.txt

Option B: If you have the templates repo locally, run the template by path:

root@kitploit:~
nuclei -t /path/to/nuclei-templates/http/cves/2016/CVE-2016-15042.yaml -u http://localhost:8090 -debug -vv \
  | tee ./debug/CVE-2016-15042-debug.txt

The debug output file is stored at ./debug/CVE-2016-15042-debug.txt for reviewers.

What this lab does

  • Boots a clean WordPress with the two vulnerable plugins
  • Configures guest uploads for Frontend File Manager for reliable unauthenticated testing
  • Exposes WordPress on localhost:8090

Notes

  • If ports or credentials collide in your setup, edit docker-compose.yml and re-run the script.
  • Artifacts are kept under ./debug/ for easy PR review.

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-15042
  • Plugin Vulnerabilities (Frontend File Manager): https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin/
  • Plugin Vulnerabilities (N‑Media Post Front‑end Form): https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/
Download Tool