CVE-2020-36847

This exploit targets a file upload vulnerability in the Simple File List WordPress plugin (CVE-2020-36847), allowing arbitrary file upload and renaming to achieve remote code execution (RCE). It uploads a PHP payload disguised as an image, renames it to a .php file, and verifies execution.

This repository contains a functional exploit for CVE-2020-36847, an arbitrary file upload vulnerability in the WordPress Simple File List plugin (version 4.2.2). The exploit uploads a malicious PHP file disguised as a PNG, renames it to execute PHP code, and confirms RCE by accessing the uploaded shell.

This Metasploit module exploits an unauthenticated file upload vulnerability in the WordPress Simple File List plugin (CVE-2020-36847). It uploads a malicious PHP payload disguised as a PNG file, renames it to a PHP file, and executes it to achieve remote code execution.