shinigami-777/PoC_CVE-2025-2568

GitHubRepository PoC

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

vuln-wordpress/docker-compose.yml

Created Vuln labCVE-2025-2568Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a WordPress site with MySQL, designed to demonstrate CVE-2025-2568 in the Vayu Blocks plugin.

vuln-wordpress/docker-compose.yml:1-27README.md:1-35

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2025-2568, and the Compose file sets up a vulnerable WordPress instance with the plugin mounted for exploitation.

README.md:1README.md:3-5vuln-wordpress/docker-compose.yml:1-27
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

MySQL database server

MySQL 5.7 service storing WordPress data, with credentials set via environment variables.

vuln-wordpress/docker-compose.yml:2-10

wordpress

WordPress application server

WordPress 6.8.3 service exposed on host port 8080, with a bind-mounted wp-content directory containing the vulnerable Vayu Blocks plugin.

vuln-wordpress/docker-compose.yml:12-22

vayu-blocks plugin

Vulnerable WordPress plugin

The Vayu Blocks plugin version 1.2.0, provided as a zip file to be extracted into wp-content/plugins, contains the vulnerable functions.

README.md:3-5README.md:10-13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-2568

Supported by supplied evidence

The README describes the vulnerability as unauthorized access and modification due to missing capability checks in the specified functions, and the provided exploit steps match this description.

README.md:3-5README.md:18-25
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7-9
  • The Vayu Blocks plugin zip must be extracted into the wp-content/plugins directory.README.md:10-13

Evidence-described exercise path

  1. Clone the repository and start the Docker Compose environment.README.md:7-9
  2. Extract the Vayu Blocks plugin zip into the mounted wp-content/plugins directory.README.md:10-13
  3. Send a GET request to the vulnerable endpoint to read plugin options.README.md:16-18
  4. Send a POST request to the vulnerable endpoint to modify option values.README.md:19-23
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained lab targeting its own WordPress instance. No evidence of host escape, external connections, persistence, or destructive behavior beyond the intended vulnerability demonstration.

vuln-wordpress/docker-compose.yml:1-27README.md:1-35
Review boundaries

What the analysis did not establish

  • The vayu-blocks.1.2.0.zip file is uninspected binary; its exact contents and behavior are unknown.
  • The exploit video referenced in the README is not included in the evidence packet.
  • No Dockerfiles or other configuration files are present to verify the full build process.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

1