CVE-2025-25163 PoC — WordPress plugin A/B Image Optimizer 路径遍历漏洞

Source

https://github.com/RootHarpy/CVE-2025-25163-Nuclei-Template

Associated Vulnerability

Title:WordPress plugin A/B Image Optimizer 路径遍历漏洞 (CVE-2025-25163)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin A/B Image Optimizer 3.3版本及之前版本存在路径遍历漏洞，该漏洞源于对路径名限制不当。

Description

This repository features a Nuclei template specifically designed to detect the Path Traversal vulnerability (CVE-2025-25163) in the Plugin A/B Image Optimizer for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access to sensitive server files.

Readme

# Nuclei Template for CVE-2025-25163

## 🚀 Overview

This repository features a Nuclei template specifically designed to detect the **Path Traversal** vulnerability (CVE-2025-25163) in the **Plugin A/B Image Optimizer** for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access to sensitive server files.

## 🔍 Vulnerability Description

CVE-2025-25163 is a path traversal vulnerability that permits attackers to manipulate file paths, enabling access to files beyond the intended directory structure. Exploitation of this vulnerability can result in the exposure of sensitive data, compromising the confidentiality and integrity of the system.

### 🛑 Affected Versions

- **Plugin A/B Image Optimizer**: Versions **up to and including 3.3**.

### 📊 CVSS Score

- **Base Score**: 7.5 (High)

### 🏷️ CVSS Vector

- `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

## 📋 Template Details

This Nuclei template attempts to exploit the path traversal vulnerability by targeting the `/etc/passwd` file—a standard technique for testing such vulnerabilities.

### 🛠️ Usage Instructions

To utilize this template with Nuclei, ensure that you have [Nuclei](https://nuclei.projectdiscovery.io/) installed. Run the following command in your terminal:

```bash
nuclei -t path/to/template.yaml -u <target_url>
```

## 👤 Author

This template was developed by [rootharpy](https://github.com/rootharpy). For inquiries or contributions, please reach out via GitHub.

File Snapshot


 [4.0K]  /data/pocs/cc936d3617a72dfd8dcf8abf871d8c2fe729ea50
├── [1.0K]  CVE-2025-25163.yaml
└── [1.5K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!