dennisec/cve-2025-3102Exploit script for CVE-2025-3102 targeting SureTriggers WordPress plugin (≤ v1.0.78). Detects vulnerable versions, exploits via REST API, and creates admin accounts with multi-threading support.
🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version (≤ v1.0.78). If successful, the script will automatically create a WordPress admin account.
⚙️ Features Detection of SureTriggers plugin version
WordPress login page validation (wp-login.php)
Exploit execution via REST API endpoint
Automatic WordPress admin user creation if target is vulnerable
Save results to vulnerable.txt file
Multi-threading for faster processing
Random User-Agent usage
🚀 How to Use 📦 Preparation Install dependencies (if not yet):
bash Copy Edit pip install requests Prepare a file containing a list of target URLs (one per line), e.g., targets.txt:
arduino Copy Edit http://example1.com https://example2.net ... 🧪 Execution bash Copy Edit python exploit.py -l targets.txt -t 10 🔧 CLI Options
Option Description -l, --target_urls Text file containing the target list -t, --threads Number of threads (default: 5) ✅ Example Output less Copy Edit [+] http://example.com - Vulnerable v1.0.75 detected. [+] http://example.com - Exploit successful! username:password [+] http://example.com/wp-login.php | username:password (saved) 📝 Notes Targets are only exploited if:
SureTriggers plugin is found
Plugin version ≤ 1.0.78
wp-login.php page is valid
The vulnerable.txt file will contain accounts successfully created in the format:
pgsql Copy Edit http://target.com/wp-login.php | username:password ⚠️ Disclaimer This script is created for educational purposes and authorized security testing. Strictly prohibited for illegal activities or without permission from the system owner. The author is not responsible for any misuse of this script.
