Sploitus

Exploit for CVE-2025-2294

kitploit · 2026-09-06

Exploit Code

MARKDOWN33 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-R0OTK3R-CVE-2025-2294
# CVE-2025-2294 - WordPress Kubio AI Page Builder <= 2.5.1 - Local File Inclusion (LFI) Exploit

* * *

## Overview

**CVE-2025-2294** affects the **Kubio AI Page Builder** plugin for WordPress (versions up to and including 2.5.1). It suffers from an **unauthenticated Local File Inclusion (LFI)** vulnerability via the `thekubio_hybrid_theme_load_template` function.

This vulnerability allows an attacker to include and execute arbitrary files on the vulnerable WordPress server, which can lead to:

  * Bypassing access controls
  * Reading sensitive server files
  * Remote code execution (if attacker can upload malicious PHP files disguised as safe file types)



* * *

## Vulnerability Details

  * **Vulnerability Type:** Local File Inclusion (LFI)
  * **Affected Plugin:** Kubio AI Page Builder
  * **Affected Versions:** ≤ 2.5.1
  * **Attack Vector:** Unauthenticated HTTP request with crafted parameters
  * **Exploitability:** High
  * **CVSS Score:** 9.8 (Critical) [CNA: Wordfence]



* * *

## Exploit Script Description