Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-32118 — WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.13 - Remote Code Execution (RCE) vulnerability | Kitploit
Tools/GitHubGitHub/nxploited/cve-2025-32118
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubnxploited/cve-2025-32118

CVE-2025-32118

WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.13 - Remote Code Execution (RCE) vulnerability

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit

🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.13 - Remote Code Execution (RCE)
🗓️ Published: 2025-04-04
🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type
📊 CVSS: 9.1 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

📜 Description

A critical Remote Code Execution (RCE) vulnerability exists in the CMP – Coming Soon & Maintenance plugin for WordPress (<= 4.1.13).
This flaw allows an authenticated admin user to upload malicious ZIP files containing executable PHP shells, leading to full site compromise.

💥 Impact

  • Upload of arbitrary PHP code inside the plugin directory
  • Unrestricted execution of system commands via web shell
  • Potential full server takeover

⚙️ Requirements

  • WordPress site with vulnerable CMP plugin installed (<= 4.1.13)
  • Valid WordPress admin credentials (Authentication Required)

💻 Usage

root@kitploit:~
python3 CVE-2025-32118.py -u http://target-site.com/wordpress -un admin -p password

✍️ Usage (CLI Help Output)

root@kitploit:~
usage: CVE-2025-32118.py [-h] -u URL -un USERNAME -p PASSWORD
Exploit For CVE-2025-32118 : By Nxploited - Khaled Alenazi

options:
  -h, --help            show this help message and exit
  -u, --url URL         Base URL of WordPress site
  -un, --username USERNAME   Admin username
  -p, --password PASSWORD    Admin password

📌 Arguments:

FlagDescription
-uBase URL of WordPress site
-unusername
-ppassword

🧪 What it does:

  1. Authenticates to the WordPress admin panel.
  2. Fetches a valid nonce for upload request.
  3. Creates a malicious ZIP with:
    • style.css (valid theme format)
    • nxploitedshell.php (RCE payload)
  4. Uploads the ZIP using the vulnerable theme upload functionality.
  5. Verifies the shell by executing ?cmd=whoami.

📂 Shell Location

Once uploaded successfully, the shell will be located at:

root@kitploit:~
/wp-content/plugins/cmp-premium-themes/nxploitedshell/nxploitedshell.php

Test it via:

root@kitploit:~
http://target-site.com/wp-content/plugins/cmp-premium-themes/nxploitedshell/nxploitedshell.php?cmd=id

❗ Disclaimer

This exploit is for educational purposes only.
Unauthorized use of this code against systems you don't own is illegal and unethical.

🔗 Reference

  • CVE-2025-32118 on MITRE
  • CWE-434: https://cwe.mitre.org/data/definitions/434.html

✒️ By:

Nxploited | Khaled Alenazi

Download Tool