Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-1247-PoC — Post Saint <= 1.3.1 plugin for WordPress Arbitrary File Upload | Kitploit
Tools/GitHubGitHub/nxploited/cve-2024-1247-poc
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubnxploited/cve-2024-1247-poc

CVE-2024-1247-PoC

Post Saint <= 1.3.1 plugin for WordPress Arbitrary File Upload

View Repository
241 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-1247-PoC

Post Saint <= 1.3.1 plugin for WordPress Arbitrary File Upload

Description

The Post Saint plugin for WordPress (versions up to and including 1.3.1) is vulnerable to arbitrary file uploads due to missing capability checks and file type validation. Authenticated attackers with at least subscriber-level access can exploit this vulnerability to upload arbitrary files, potentially leading to remote code execution.

Features

  • Detects vulnerable plugin versions.
  • Logs into WordPress using provided credentials.
  • Exploits the vulnerability to upload arbitrary files.

Usage

Prerequisites

  1. Install Python 3.8 or later.
  2. Install the required libraries:
root@kitploit:~
  
pip install requests packaging urllib3

Usage -help

root@kitploit:~

 CVE-2024-12471 | Post Saint plugin for wordpress Arbitrary File Upload

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Base URL of the WordPress site
  -un USERNAME, --username USERNAME
                        WordPress username
  -p PASSWORD, --password PASSWORD
                        WordPress password
  -ru REMOTE_URL, --remote_url REMOTE_URL
                        Remote URL of the shell file to inject

Example:

root@kitploit:~
python CVE-2024-12471.py -u <Base URL> -un <Username> -p <Password> -ru <Remote Shell URL>

Disclaimer

This script is for educational and research purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.

Download Tool