jayhutajulu1/cve-2021-24499

This repository contains a proof-of-concept exploit tool for a known security vulnerability (CVE-2021-24499) in a WordPress theme called Workreap. The theme is used to build freelance marketplace websites, and versions 2.2.2 and below have a critical flaw: they allow anyone, even someone with no account or login, to upload files to the site. That alone is bad, but the real danger is that an attacker can upload a PHP script (a "webshell"), which then lets them run commands on the server remotely. This is called Remote Code Execution, and it's about as serious as a vulnerability gets. The tool is a Bash shell script that automates the attack. You run it from a command line on Linux, macOS, or Windows Subsystem for Linux, and it uses curl (a common tool for making web requests) to send a crafted upload request to a target site. If the site is running the vulnerable theme and hasn't patched it, the script uploads a PHP webshell, a file that lets the attacker send commands to the server through the browser. You can point it at a single URL or feed it a list of many URLs at once for what the README calls "mass exploitation." The people who would use this are security researchers, penetration testers, or administrators checking whether their own sites are vulnerable. For example, if you manage several WordPress sites and want to confirm whether any are still running the old Workreap theme, you could run this against a list of your own URLs to see which ones are exposed. The script reports each site as either "VULNERABLE" or "NOT VULNERABLE" and, for vulnerable sites, prints the path where the uploaded shell landed. The README includes a disclaimer that the tool is for educational and authorized testing only, and that users are responsible for ensuring they have permission before testing any system. That's worth taking seriously, running this against a site you don't own or have written authorization to test would be illegal in most jurisdictions. One thing worth noting: the project is straightforward and lightweight. It's just a shell script plus a PHP file you supply, with no complex dependencies or frameworks. That simplicity makes it easy to study for someone learning how this specific vulnerability works, but it also means the tool does exactly one thing and doesn't dress it up.