🔓 CVE-2025-6934 Exploit Tool

Unauthenticated Administrator Account Creation in WordPress Plugin Opal Estate Pro

Created and developed fully by mejbankadir (SMH tech and Mejban HackSheild Under NexoAmicus)

📋 Description

CVE-2025-6934 is a critical vulnerability in the WordPress Opal Estate Pro plugin (versions <= 1.7.5) that allows unauthenticated attackers to create administrator accounts on vulnerable WordPress sites.

This tool provides both CLI (Command Line) and GUI (Graphical User Interface) versions for exploiting this vulnerability.

⚠️ Vulnerability Details

🛠️ Installation

Prerequisites

# Clone the repository
git clone https://github.com/mejbankadir/CVE-2025-6934.git
cd CVE-2025-6934

# Install dependencies
pip install -r requirements.txt

Requirements

requests
beautifulsoup4
colorama
PyQt6        # For GUI version only

🚀 Usage

GUI Version (Recommended)

python3 CVE-2025-6934-GUI.py

GUI Features:

Modern dark-themed interface
Real-time exploit progress
Colored console output
Input validation
Non-blocking execution

CLI Version

python3 CVE-2025-6934.py -u http://target.com -mail [email protected] -password P@ssw0rd123

Arguments:

-u, --url        Target URL (required)
-mail, --newmail Email for admin account (required)
-password, --newpassword Password for admin account (required)
-user, --username Username for admin account (default: administrator)

📖 Example

┌─────────────────────────────────────────────────────────────┐
│  _____________   _______________                            │
│  \_   ___ \   \ /   /\_   _____/                           │
│  /    \  \/\   Y   /  |    __)_   ______                   │
│  \     \____\     /   |        \ /_____/                   │
│   \______  / \___/   /_______  /                           │
│           \/                  \/                           │
│                                                             │
│          CVE-2025-6934 Exploit PoC                         │
│                                                             │
│  Created and developed fully by mejbankadir                │
│  (SMH tech and Mejban HackSheild Under NexoAmicus)        │
└─────────────────────────────────────────────────────────────┘

CLI Example

$ python3 CVE-2025-6934.py -u http://example.com -mail [email protected] -password MyP@ss123

[•] Starting Exploit Attempt...
[•] Nonce Found: a1b2c3d4e5f6...
[✔] Exploit Successful!
    Username : administrator
    Email    : [email protected]
    Password : MyP@ss123
    Role     : administrator

🎨 Features

CLI Version

✅ Banner with ASCII art
✅ Colorized output (using colorama)
✅ Version checking
✅ Nonce extraction
✅ JSON response handling

GUI Version

✅ Modern dark theme UI
✅ Real-time console output
✅ Input validation
✅ Background thread execution
✅ Status bar
✅ Responsive design

🔒 Security Notice

⚠️ WARNING: This tool is provided for educational and authorized security testing purposes only.

Unauthorized access to computer systems is illegal and unethical.

By using this tool, you agree to:

Only test systems you own or have explicit permission to test

Not use this tool for malicious purposes

Accept all responsibility for any legal consequences

📝 Credits

Role	Name
Creator & Developer	mejbankadir
Organization	SMH tech & Mejban HackSheild Under NexoAmicus

📂 Project Structure

CVE-2025-6934/
├── CVE-2025-6934.py       # CLI version
├── CVE-2025-6934-GUI.py   # GUI version
├── CVE-2025-6934.yaml     # Documentation
├── requirements.txt       # Python dependencies
└── README.md             # This file

🐛 Troubleshooting

SSL Certificate Errors

The tool automatically disables SSL warnings. If you encounter issues:

requests.packages.urllib3.disable_warnings()

Nonce Extraction Failures

Ensure the target URL is correct
Check if Opal Estate Pro plugin is installed
Verify the site is running WordPress

📜 License

MIT License

Made with ❤️ by mejbankadir

SMH tech | Mejban HackSheild | Under NexoAmicus

CVE ID	CVE-2025-6934
Severity	Critical (CVSS 3.1: 9.8)
Affected Plugin	Opal Estate Pro
Affected Versions	<= 1.7.5
Vulnerability Type	Unauthenticated Administrator Account Creation
CVSS Vector	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2025-6934-PoC

Most Popular