Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-10041. PoCs published by Nxploited, Boshe99.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-10041, an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator WordPress plugin (≤ 1.2.5). The exploit automates the upload of a PHP webshell by leveraging missing file type validation in the `save_qr_code_to_db()` function.
Description
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (2)
This repository contains a functional exploit for CVE-2025-10041, an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator WordPress plugin (≤ 1.2.5). The exploit automates the upload of a PHP webshell by leveraging missing file type validation in the `save_qr_code_to_db()` function.
This repository contains a functional exploit for CVE-2025-10041, targeting an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator WordPress plugin (≤ 1.2.5). The exploit automates version detection, payload generation, and file upload to achieve remote code execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H