
Exploit tool for SportsPress Plugin LFI & RCE (CVE-2025-15368) - Proof of Concept
Author: kazehere4you
Date: 2026-02-11
This tool exploits a Local File Inclusion (LFI) vulnerability in the SportsPress plugin for WordPress (versions up to and including 2.7.26). By leveraging the [event_list] shortcode and manipulating the template_name attribute, an authenticated attacker (Contributor+) can include arbitrary files.
Furthermore, this tool includes a chain to achieve Remote Code Execution (RCE) by uploading a malicious image file and including it via the LFI vulnerability (requires Author+ privileges for file upload).
/etc/passwd).media-new.phpupload.phprequests library (pip install requests)Leak /etc/passwd or other system files:
python CVE-2025-15368_Exploit.py -u http://target.com -user hacker -p password --lfi /etc/passwd
Execute system commands (requires Author role):
python CVE-2025-15368_Exploit.py -u http://target.com -user hacker -p password --rce "id"
This tool is for educational purposes and authorized security testing only. The author is not responsible for any misuse of this software. Use it only on systems you own or have explicit permission to test.