CVE-2025-13597

CRITICAL

AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload via actualizador_git.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-13597. PoCs published by d0n601.

AI-analyzed exploit summary This PoC exploits an unauthenticated arbitrary file upload vulnerability in the AI Feeds WordPress plugin (CVE-2025-13597) by abusing the `actualizador_git.php` endpoint to download and extract a malicious GitHub repository, resulting in remote code execution via a planted shell.php.

Description

The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible.

Exploits (1)

nomisec WORKING POC
by d0n601 · poc
https://github.com/d0n601/CVE-2025-13597

This PoC exploits an unauthenticated arbitrary file upload vulnerability in the AI Feeds WordPress plugin (CVE-2025-13597) by abusing the `actualizador_git.php` endpoint to download and extract a malicious GitHub repository, resulting in remote code execution via a planted shell.php.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: AI Feeds WordPress plugin <= 1.0.11
No auth needed
Prerequisites: Target running vulnerable AI Feeds plugin · GitHub repository with malicious shell.php · GitHub Personal Access Token
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 9.8
EPSS 0.0082
EPSS Percentile 52.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
soportecibeles/AI Feeds < 1.0.11
Published Nov 25, 2025
Tracked Since Feb 18, 2026