CVE-2024-28890 PoC — WordPress plugin Forminator 安全漏洞

Source

https://github.com/RHYru9/CVE-2024-28890-checker

Associated Vulnerability

Title: WordPress plugin Forminator 安全漏洞 (CVE-2024-28890)
Description:Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.

Readme

# Exploit Script

This repository contains a Python script (`exp.py`) designed to check for vulnerabilities FORMINATOR RCE and execute a reverse shell on a given URL.

## Usage

## checker
```sh
python check.py
```
To use the script, run the following command:
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7
```
## check vuln or not
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7 -v
```

## reverse shell
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7 -r
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →