CVE-2025-3515 PoC — WordPress plugin Drag and Drop Multiple File Upload for Contact Form 代码问题漏洞

Description

CVE-2025-3515 WordPress lab for Drag and Drop Multiple File Upload for CF7: Dockerized PoC & Nuclei testing

介绍

# CVE-2025-3515 WordPress Lab (Drag and Drop Multiple File Upload for Contact Form 7)

Spin up a vulnerable WordPress environment to reproduce and validate CVE-2025-3515 — unrestricted file upload via `ddmu_upload_file` in the plugin `drag-and-drop-multiple-file-upload-contact-form-7` (≤ 1.3.8.9). This lab is Dockerized for quick, deterministic testing with Nuclei.

- Vulnerable plugin: `drag-and-drop-multiple-file-upload-contact-form-7` v1.3.8.9
- Core dependency: Contact Form 7 (auto-installed)
- Endpoint of interest: `/wp-admin/admin-ajax.php?action=ddmu_upload_file`

## Quickstart

1. Start the lab

```bash
docker compose up -d
```

1. Wait 15-45s for init. Confirm WP is reachable:

```bash
curl -I http://localhost:8080/wp-login.php | head -n1
```

1. Run the Nuclei PoC template from repo root

```bash
nuclei -u http://localhost:8080 -t http/cves/2025/CVE-2025-3515.yaml -vv -debug
```

Containerized alternative (uses the same docker network):

```bash
docker run --rm --network lab-cve-2025-3515_default \
  -v "$(pwd)":/workspace \
  projectdiscovery/nuclei:latest \
  -u http://wordpress \
  -t /workspace/http/cves/2025/CVE-2025-3515.yaml -vv -debug
```

### Credentials

- WP Admin: admin / admin

### Notes

- This lab demonstrates arbitrary file upload and code execution under Apache + mod_php style containers. The included Nuclei template uploads a short PHP payload that self-deletes after echoing a marker for verification.
- For safety, only run against local or authorized targets.

### Tags / Topics

wordpress, contact-form-7, drag-and-drop-multiple-file-upload-contact-form-7, ddmu_upload_file, arbitrary file upload, rce, nuclei, docker lab, security research, CVE-2025-3515

文件快照

备注