CVE-2025-8625 — PoC

Overview

This repository contains the source files for an article on Xakep.ru.
The repository contains demonstration materials intended exclusively for security research, education, and testing in isolated laboratory environments. The repository is not intended for use against systems you do not own.

---

Repository contents

• docker-compose.yml — configuration for spinning up a local, isolated WordPress instance for analysis and testing.
• exploit/CVE-2025-8625.py — example exploit code used in the article to demonstrate the concepts. Do not use against systems you do not own or for which you do not have explicit permission.
• exploit/shell.php — example web shell included only to demonstrate behavior in a controlled laboratory environment.

---

Important — safety and ethics

• The repository may contain materials demonstrating exploitation concepts. They are provided only for educational and defensive purposes.
• DO NOT use materials from this repository against systems you do not own or without the owner's written permission. Unauthorized access is a criminal and/or administrative offense.
• Perform testing only in an isolated laboratory (host-only / NAT / air-gapped), on test virtual machines or containers with rollback capability (snapshots). Do not perform exploitation in production environments.
• The author and the magazine's editorial staff accept no responsibility for misuse of the materials. All responsibility lies with the person who downloads/executes them.
• If you discover a vulnerability in a real system, follow responsible disclosure practices: limit evidence collection to the necessary minimum, do not perform exploitation in production, and contact the vendor or the relevant CERT/CSIRT.

---

License and legal notices

The repository is provided "as is" without any warranties. By using the materials, you agree that you are responsible for complying with applicable law. When in doubt — seek legal advice.