# CVE-2025-23922 - WordPress iSpring Embedder CSRF to Arbitrary File Upload ### 📌 CVE Details - **CVE ID:** CVE-2025-23922 - **Published:** 2025-01-16 - **Plugin Affected:** WordPress iSpring Embedder plugin - **Versions Affected:** <= 1.0 - **Author of Plugin:** Harsh - **Vulnerability Type:** Cross-Site Request Forgery (CSRF) → Arbitrary File Upload - **CWE ID:** [CWE-352: Cross-Site Request Forgery (CSRF)](https://cwe.mitre.org/data/definitions/352.html) - **CVSS Score:** 10.0 (Critical) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` --- ### 🔥 Description A **CSRF vulnerability** in the **iSpring Embedder WordPress plugin** allows an unauthenticated remote attacker to **trick an authenticated administrator** into uploading arbitrary files (such as a PHP web shell) to the server. The vulnerable endpoint does not implement any CSRF protection, and the file upload feature accepts `.zip` files, which are extracted to the following location: ``` /wp-content/uploads/iSpring_embedder/ ``` --- ### 💡 Impact An attacker can: - Trigger file uploads without authentication. - Gain remote code execution (RCE) by uploading a malicious PHP file inside a ZIP archive. - Compromise the entire web server by chaining this with a crafted web shell. --- ### 🚀 Proof-of-Concept (PoC) Exploit (HTML) ```html CSRF File Upload Exploit

CSRF Exploit – File Upload

This is a proof-of-concept (PoC) exploit for the following vulnerability:



Exploit for CSRF to Arbitrary File Upload vulnerability
CVE-2025-23922
Developed by Nxploit | Khaled Alenazi

``` --- --- ### ⚠️ Disclaimer This proof-of-concept is provided for educational and research purposes only. The author is not responsible for any misuse or damage caused by this exploit. **Nxploit | Khaled Alenazi** Security Researcher & Exploit Developer [https://github.com/Nxploit](https://github.com/Nxploited)