Exploit for CVE-2025-10041

githubexploit · 2025-10-20

Description

This describes an exploit and proof of concept for the vulnerability identified as 2025-10041.

Parameteraction · request body

Pathwp-admin/admin-ajax.php

Unauthenticated arbitrary file upload via flexqr_save_qr AJAX endpoint enabling remote code execution

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

33%confidence this exploit runs

Based on 1 file(s) in the source

0.9%higher than 54.8% of all CVEs

Updated 2026-07-30

Modified:2025-10-20 15:12

Last Seen:2025-10-20 15:14

Reporter:DExplo1ted

Repository:No longer on GitHub

README2 lines

## https://sploitus.com/exploit?id=4F557333-50F7-5EED-9039-4923A92C6DEC
# CVE-2025-10041---POC