Alpastx/CVE-2023-3452---WordPress-Canto-Plugin-RCE

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2023-3452, an unauthenticated Remote File Inclusion (RFI) vulnerability in the WordPress Canto plugin (≤ 3.0.4), to achieve Remote Code Execution (RCE). It serves a malicious PHP file via a local HTTP server and triggers the inclusion via the 'wp_abspath' parameter.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2023-3452. It creates a temporary PHP file containing a user-supplied command, serves it via a local HTTP server, and triggers the target's RFI vulnerability to execute it. All behavior is consistent with the stated purpose of demonstrating the CVE. No concealed, deceptive, or unrelated harmful actions were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonPHP
Target softwareWordPress Canto Plugin
Attack typesRemote File InclusionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (canto_exploit.py) that actively exploits a vulnerability to execute arbitrary commands on a remote target. It includes a full exploitation chain: vulnerability check, payload generation, HTTP server setup, and RFI trigger. The README explicitly describes it as an 'Exploit' and provides usage examples for achieving RCE.

README.md:3canto_exploit.py:1-3canto_exploit.py:127-168

Requirements

  • Target must be running a vulnerable version of the WordPress Canto plugin (≤ 3.0.4).canto_exploit.py:110-111
  • The attacker's machine must be reachable from the target server on the specified payload port.README.md:99-100
  • The target server must have 'allow_url_include' enabled for remote file inclusion to work.README.md:17

Observed behavior

  • Checks if the target is vulnerable by fetching the plugin's readme.txt and parsing the version number.canto_exploit.py:94-125
  • Creates a malicious PHP file (wp-admin/admin.php) containing a system() call with the attacker-supplied command.canto_exploit.py:62-73
  • Starts a local HTTP server to host the malicious PHP file.canto_exploit.py:75-86
  • Sends a request to the vulnerable download.php endpoint with the 'wp_abspath' parameter pointing to the attacker's server, causing the target to include and execute the remote PHP file.canto_exploit.py:139-144
  • Displays the output of the executed command returned in the HTTP response.canto_exploit.py:146-158
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
The script writes a PHP file with a user-supplied command to /tmp/canto_exploit/wp-admin/admin.php, serves it via HTTP, and triggers the target's RFI vulnerability to execute it.This is the core exploit logic, consistent with the documented CVE-2023-3452 vulnerability.canto_exploit.py:62-70canto_exploit.py:75-86canto_exploit.py:127-170
Network Behavior
The script disables SSL verification (verify=False) and suppresses InsecureRequestWarning.This is explicitly documented in the README as a feature to support HTTPS targets, and is a common practice in exploit scripts.canto_exploit.py:29canto_exploit.py:101canto_exploit.py:144
Payload Generation
The payload is a simple PHP file: <?php system("{command}"); ?>The command is directly taken from user input or a default sanity check ('id; whoami; hostname'). No hidden or additional commands are injected.canto_exploit.py:67canto_exploit.py:266
Review boundaries

What the analysis did not establish

  • One file (metadata only) was omitted from the evidence packet, but all readable text files are included and complete.
  • The evidence does not include the target's server configuration, so the prerequisite 'allow_url_include' cannot be verified from the artifact alone.
  • One file (metadata only) was omitted from the text evidence; its content was not reviewed.
  • The review is based solely on the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1