puppetma4ster Exploits and Proofs of Concept

Showing 1 PoC on this page

GitHub

puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCE

Repository PoC0Created 2026-03-06ExploitCVE-2023-3452 CVE-2024-2509615 files

303.1 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

A Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096, which are Remote File Inclusion vulnerabilities in the WordPress Canto plugin. The module includes a check method to detect vulnerable versions and an exploit method that starts an HTTP server to serve a PHP payload, triggering code execution via the 'abspath' or 'wp_abspath' parameters.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and wp_canto_rfi_rce.rb) describe and implement a standard Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096. The module uses a built-in PHP include server to deliver a Meterpreter payload, which is normal exploit behavior. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareWordPress Canto plugin

Attack typesremote file inclusionremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module that actively exploits the vulnerability by serving a payload and triggering remote file inclusion to achieve code execution. The README describes it as a 'proof-of-work exploit' and provides usage instructions for obtaining a Meterpreter session.

README.md:3-4wp_canto_rfi_rce.rb:128-150

Requirements

Canto plugin version <= 3.0.6 installed on target WordPress sitewp_canto_rfi_rce.rb:30
PHP configuration must have allow_url_include enabled on the target serverwp_canto_rfi_rce.rb:27

Observed behavior

Checks the target's Canto plugin version by fetching readme.txt and parsing the 'Stable tag'wp_canto_rfi_rce.rb:85-101
Verifies the vulnerable PHP file is reachable on the target serverwp_canto_rfi_rce.rb:95-98
Starts an HTTP server to host the PHP payloadwp_canto_rfi_rce.rb:129-130
Sends a request to the vulnerable file with the attacker-controlled 'abspath' or 'wp_abspath' parameter pointing to the attacker's serverwp_canto_rfi_rce.rb:141-147
Serves the Metasploit payload when the target server fetches admin.php or image.php from the attacker's HTTP serverwp_canto_rfi_rce.rb:152-159

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism: Payload withheldThe exploit triggers RFI in the Canto plugin to include a PHP payload served by Metasploit's built-in HTTP server.wp_canto_rfi_rce.rb:128-150
Payload Delivery: Payload withheldThe on_request_uri method serves the configured Metasploit payload when the target fetches the include URL. This is standard Metasploit behavior.wp_canto_rfi_rce.rb:152-163

Review boundaries

What the analysis did not establish

Only two text files (README.md and wp_canto_rfi_rce.rb) were provided; 8 other text files and 5 non-text files were omitted.
The evidence does not include the full repository contents, such as the Docker Compose file or documentation screenshots referenced in the README.
Only two text files (README.md, wp_canto_rfi_rce.rb) were reviewed; 13 other files (including 5 non-text media files and 8 unclassified files) were not inspected. The repository may contain additional content not covered by this review.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

puppetma4ster

Exploit catalog results