🔐 WordPress SoJ SoundSlides Plugin <= 1.2.2 - Authenticated Arbitrary File Upload

⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only.

📌 Vulnerability Summary

• Plugin: SoJ SoundSlides  
• Affected Versions: <= 1.2.2  
• Type: Authenticated (Contributor+) Arbitrary File Upload  
• Patch Status: ❌ No official fix available

The SoJ SoundSlides plugin allows authenticated users with Contributor or higher roles to upload arbitrary ZIP files. Due to missing validation, attackers can upload PHP webshells that are extracted and executed from a web-accessible directory.

💥 Impact

An attacker with valid WordPress credentials can:

• 📦 Upload a ZIP archive containing a PHP shell
• 🖥️ Execute system commands remotely (?cmd=)
• 🔓 Gain unauthorized control of the site/server

🛠️ Usage

usage: CVE-2025-2249.py [-h] -u URL -un USERNAME -p PASSWORD

Exploit for CVE-2025-2249 | WordPress SoJ SoundSlides Plugin # By Nxploited | Khaled ALenazi,

options:
  -h, --help            show this help message and exit
  -u, --url URL         WordPress base URL
  -un, --username USERNAME
                        WordPress username
  -p, --password PASSWORD
                        WordPress password