CVE-2025-3776
HIGHWordPress TargetSMS <= 1.5 - Unauthenticated Callable Function Execution
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2025-3776. PoCs published by Nxploited, Boshe99.
AI-analyzed exploit summary This is a functional exploit for CVE-2025-3776, targeting a Remote Code Execution (RCE) vulnerability in the 'Verification SMS with TargetSMS' WordPress plugin <= 1.5. The exploit leverages an unsafe use of `call_user_func()` on user-controlled input, allowing unauthenticated attackers to execute arbitrary commands if a malicious function is pre-loaded into memory.
Description
The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().
Exploits (2)
This is a functional exploit for CVE-2025-3776, targeting a Remote Code Execution (RCE) vulnerability in the 'Verification SMS with TargetSMS' WordPress plugin <= 1.5. The exploit leverages an unsafe use of `call_user_func()` on user-controlled input, allowing unauthenticated attackers to execute arbitrary commands if a malicious function is pre-loaded into memory.
The repository contains functional exploit code for CVE-2025-3776, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the exploit by uploading a shell to a vulnerable endpoint.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L