Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-15368-Exploit — Exploit tool for SportsPress Plugin LFI & RCE (CVE-2025-15368) - Proof of Concept | Kitploit
Tools/GitHubGitHub/kazehere4you/cve-2025-15368-exploit
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubkazehere4you/cve-2025-15368-exploit

CVE-2025-15368-Exploit

Exploit tool for SportsPress Plugin LFI & RCE (CVE-2025-15368) - Proof of Concept

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
7 months agoNot yet reviewed
Share

CVE-2025-15368 Exploit Tool

SportsPress Plugin for WordPress (<= 2.7.26) - LFI & RCE

Author: kazehere4you
Date: 2026-02-11

Description

This tool exploits a Local File Inclusion (LFI) vulnerability in the SportsPress plugin for WordPress (versions up to and including 2.7.26). By leveraging the [event_list] shortcode and manipulating the template_name attribute, an authenticated attacker (Contributor+) can include arbitrary files.

Furthermore, this tool includes a chain to achieve Remote Code Execution (RCE) by uploading a malicious image file and including it via the LFI vulnerability (requires Author+ privileges for file upload).

Features

  • LFI Mode: Automatically detects traversal depth and leaks sensitive files (e.g., /etc/passwd).
  • RCE Mode: Automates malicious file upload, nonce retrieval, and command execution.
  • Handles different nonce locations (, ) and dynamic paths.
Smart Detection:
media-new.php
upload.php

Usage

Prerequisites

  • Python 3.x
  • requests library (pip install requests)
  • Valid WordPress credentials (Contributor role or higher)

1. Local File Inclusion (LFI)

Leak /etc/passwd or other system files:

root@kitploit:~
python CVE-2025-15368_Exploit.py -u http://target.com -user hacker -p password --lfi /etc/passwd

2. Remote Code Execution (RCE)

Execute system commands (requires Author role):

root@kitploit:~
python CVE-2025-15368_Exploit.py -u http://target.com -user hacker -p password --rce "id"

Disclaimer

This tool is for educational purposes and authorized security testing only. The author is not responsible for any misuse of this software. Use it only on systems you own or have explicit permission to test.

Download Tool