CVE-2025-28915

This is a functional exploit for CVE-2025-28915, an arbitrary file upload vulnerability in the WordPress ThemeEgg ToolKit plugin (versions ≤ 1.2.9). It automates version checking, authentication, nonce extraction, and uploads a PHP web shell for remote code execution.

The repository contains functional exploit code for CVE-2025-28915, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.

This exploit targets a file upload vulnerability in WordPress ThemeEgg ToolKit (CVE-2025-28915), allowing authenticated users to upload a malicious PHP shell. The PoC logs in, extracts a security nonce, and uploads a shell via the vulnerable endpoint.