Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/joshuaprovoste/0-click-rce-exploit-for-cve-2023-51409
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingRemote Access Tool
GitHubjoshuaprovoste/0-click-rce-exploit-for-cve-2023-51409

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

0-click-RCE-Exploit-for-CVE-2023-51409

Unauthenticated 0-click RCE exploit for CVE-2023-51409. Abuses an arbitrary file upload flaw in the AI Engine WordPress plugin to upload a PHP webshell and achieve remote command execution without authentication, including OS detection and an interactive shell.

View Repository
17 months agoNot yet reviewed

CVE-2023-51409 / 0-Click RCE Exploit

  • Author: Joshua Provoste
  • https://x.com/JoshuaProvoste/status/1858586463777989073

CVE-2023-51409

This repository contains a proof-of-concept exploit for CVE-2023-51409, an unauthenticated arbitrary file upload vulnerability in the AI Engine: ChatGPT Chatbot WordPress plugin, leading to remote command execution (RCE).

What the script does

The script uploads a PHP payload through a vulnerable REST endpoint without authentication, deploys it into the WordPress uploads directory, detects the target operating system, and provides an interactive remote shell for command execution.

Usage

root@kitploit:~
python CVE-2023-51409.py --target http://target-wordpress-site

Once executed, the script automatically uploads the payload, validates accessibility, detects the OS, and drops into an interactive shell.

Notes

  • No authentication required (pre-auth / 0-click).
  • Works against vulnerable plugin versions only.
  • Intended for security research and controlled environments.
Download Tool