CVE-2024-9234

This PoC demonstrates an unauthenticated arbitrary file upload vulnerability in GutenKit <= 2.1.0 via the `install-active-plugin` REST API endpoint, allowing attackers to install and activate arbitrary plugins.

This PoC exploits an unauthenticated arbitrary file upload vulnerability in GutenKit <= 2.1.0 by leveraging the `/wp-json/gutenkit/v1/install-active-plugin` endpoint to install a plugin without authentication. The script first checks for the vulnerable plugin version before attempting the exploit.

The repository contains functional exploit code for CVE-2024-9234, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.