CVE-2025-13374

Kalrav AI Agent = 2.3.3 - 通过 kalravuploadfile AJAX 操作实现未认证任意文件上传 WordPress Kalrav AI Agent 插件（2.3.3 及更早版本）包含一个任意文件上传漏洞，允许未认证用户向服务器上传恶意 PHP 文件，可能导致远程代码执行。 TL;DR 漏洞利用 提供了一个 POC CVE-2025-13374.py，用于演示远程攻击者上传 shell.php 并执行远程代码： root@kitploit: python3 ./CVE-2025-13374.py http://techcorp.cc + Target:...

CVE-2025-13374 Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action

The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalravuploadfile AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site...