CVE-2024-25096

This repository contains a functional Metasploit module that exploits CVE-2024-25096 and CVE-2023-3452, which are remote file inclusion vulnerabilities in the WordPress Canto plugin. The exploit leverages unsanitized parameters (`abspath` and `wp_abspath`) to achieve remote code execution when PHP's `allow_url_include` is enabled.

This repository contains a functional Metasploit exploit module for CVE-2024-25096, targeting an unauthenticated file upload vulnerability in the Canto WordPress plugin (versions <= 3.0.7). The exploit leverages RFI (Remote File Inclusion) to achieve RCE by serving a malicious PHP payload via an HTTP server.