CVE-2024-25096: WordPress canto plugin <= 3.0.7

Record summary

CVE-2024-25096 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.

Description source: CVE List

Exploitation context

Available material

Repository PoCs: 1
Lab environments: 1

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 29, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Canto Browse Canto Inc. / Canto Default status: unaffected	CVE List	Through 3.0.7	affected
canto Browse canto / canto Default status: unknown	CVE List	Through 3.0.7	affected

Proofs of concept

Repository PoCs

GitHubpuppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCERepository PoCby puppetma4ster0Exploit15 files

303.1 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

A Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096, which are Remote File Inclusion vulnerabilities in the WordPress Canto plugin. The module includes a check method to detect vulnerable versions and an exploit method that starts an HTTP server to serve a PHP payload, triggering code execution via the 'abspath' or 'wp_abspath' parameters.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and wp_canto_rfi_rce.rb) describe and implement a standard Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096. The module uses a built-in PHP include server to deliver a Meterpreter payload, which is normal exploit behavior. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareWordPress Canto plugin

Attack typesremote file inclusionremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module that actively exploits the vulnerability by serving a payload and triggering remote file inclusion to achieve code execution. The README describes it as a 'proof-of-work exploit' and provides usage instructions for obtaining a Meterpreter session.

README.md:3-4wp_canto_rfi_rce.rb:128-150

Requirements

Canto plugin version <= 3.0.6 installed on target WordPress sitewp_canto_rfi_rce.rb:30
PHP configuration must have allow_url_include enabled on the target serverwp_canto_rfi_rce.rb:27

Observed behavior

Checks the target's Canto plugin version by fetching readme.txt and parsing the 'Stable tag'wp_canto_rfi_rce.rb:85-101
Verifies the vulnerable PHP file is reachable on the target serverwp_canto_rfi_rce.rb:95-98
Starts an HTTP server to host the PHP payloadwp_canto_rfi_rce.rb:129-130
Sends a request to the vulnerable file with the attacker-controlled 'abspath' or 'wp_abspath' parameter pointing to the attacker's serverwp_canto_rfi_rce.rb:141-147
Serves the Metasploit payload when the target server fetches admin.php or image.php from the attacker's HTTP serverwp_canto_rfi_rce.rb:152-159

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism: Payload withheldThe exploit triggers RFI in the Canto plugin to include a PHP payload served by Metasploit's built-in HTTP server.wp_canto_rfi_rce.rb:128-150
Payload Delivery: Payload withheldThe on_request_uri method serves the configured Metasploit payload when the target fetches the include URL. This is standard Metasploit behavior.wp_canto_rfi_rce.rb:152-163

Review boundaries

What the analysis did not establish

Only two text files (README.md and wp_canto_rfi_rce.rb) were provided; 8 other text files and 5 non-text files were omitted.
The evidence does not include the full repository contents, such as the Docker Compose file or documentation screenshots referenced in the README.
Only two text files (README.md, wp_canto_rfi_rce.rb) were reviewed; 13 other files (including 5 non-text media files and 8 unclassified files) were not inspected. The repository may contain additional content not covered by this review.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yaml

puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCECreated 2026-03-06Vuln labCVE-2023-3452 CVE-2024-25096Compose · images

1 Compose manifest · 2 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose environment defining a WordPress 6.4 service with a MariaDB 10.6 database, configured to allow remote file inclusion via a mounted PHP configuration file, intended as a lab for exploiting Canto plugin RFI vulnerabilities.

docker-compose.yaml:1-29rfi.ini:1-3

Lab assessment

Vulnerability lab

The README explicitly states the environment is for demonstrating CVE-2023-3452 and CVE-2024-25096, provides setup instructions for a vulnerable Canto plugin, and includes a Metasploit exploit module. The Docker Compose file mounts a PHP configuration enabling allow_url_include, a prerequisite for the RFI vulnerabilities.

README.md:1-5docker-compose.yaml:24-25

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database

MariaDB 10.6 service providing the WordPress database, configured with root and wp user credentials.

docker-compose.yaml:5-11

wordpress

web applicationvulnerable target

WordPress 6.4 service with port 8889 mapped to container port 80, mounting a plugins directory and a PHP configuration file that enables allow_url_include, making it susceptible to RFI attacks when a vulnerable Canto plugin is installed.

docker-compose.yaml:13-25rfi.ini:1

wp_canto_rfi_rce.rb

exploit module

A Metasploit exploit module targeting CVE-2023-3452 and CVE-2024-25096 in the Canto WordPress plugin. It exploits unsanitized abspath and wp_abspath parameters to achieve remote file inclusion and code execution.

wp_canto_rfi_rce.rb:1-165

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-3452

Supported by supplied evidence

The README describes CVE-2023-3452 as an RFI vulnerability via the wp_abspath parameter in require_once, and the exploit module includes logic to use wp_abspath for specific target files. The lab environment is configured with allow_url_include enabled, matching the vulnerability prerequisites.

README.md:7-9wp_canto_rfi_rce.rb:130-135

CVE-2024-25096

Supported by supplied evidence

The README describes CVE-2024-25096 as an RFI vulnerability via the abspath parameter in include_once, and the exploit module includes logic to use abspath for specific target files. The lab environment is configured with allow_url_include enabled, matching the vulnerability prerequisites.

README.md:5-7wp_canto_rfi_rce.rb:130-135

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Canto plugin version <= 3.0.6 must be installed in the WordPress instance.README.md:17-18
PHP configuration must have allow_url_include enabled, which is provided by the mounted rfi.ini file.README.md:19rfi.ini:1
The attacker must have network access to the WordPress service on the mapped port (8889).docker-compose.yaml:16-17

Evidence-described exercise path

Start the Docker Compose environment with podman-compose up.README.md:29
Access http://localhost:8889/wp-admin/install.php to set up a WordPress account.README.md:30
Install a vulnerable Canto plugin (version <= 3.0.6) via the WordPress admin panel.README.md:33
Add the exploit module to Metasploit and configure it with the target's address, port, and vulnerable file.README.md:39-47
Run the exploit to trigger RFI and obtain a Meterpreter session on the target.README.md:49-88

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The exploit module's actions (RFI, payload delivery, reverse shell) are expected for demonstrating the stated vulnerabilities. No evidence of host escape, external connections beyond the lab, persistence, credential theft, or destructive behavior is present.

wp_canto_rfi_rce.rb:1-165README.md:1-122

Review boundaries

What the analysis did not establish

The exploit module (wp_canto_rfi_rce.rb) is a text script and its behavior is assessed from source code; no binary analysis was performed.
The Docker Compose file mounts a host directory (./plugins) into the container, which could be used to introduce malicious plugins, but no such plugins are present in the evidence.
The README references screenshots (docs/*.png) that are not included in the text evidence, so their content cannot be verified.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-25096

patchstack.comvdb entry

https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve