CVE-2024-10674 Exploit - Th Shop Mania <= 1.4.9

🚀 Overview

This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitrary plugins without proper authorization. This exploit can be leveraged to install malicious plugins, leading to potential remote code execution and privilege escalation.

🔍 Vulnerability Details

Title: Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

Description: The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation.

⚙️ Exploit Requirements

• WordPress site running Th Shop Mania theme version <= 1.4.9.
• Valid WordPress credentials with at least Subscriber-level access.

🌟 Exploit Features

• Checks if the target WordPress site is vulnerable.
• Authenticates to the WordPress site using provided credentials.
• Installs and activates the specified plugin.
• Confirms the activation of the plugin.

🛠️ Usage

usage: CVE-2024-10674.py [-h] -u URL -U USERNAME -P PASSWORD [-p PLUGIN]

Exploit for CVE-2024-10674 (# By Nxploit | Khaled alenazi,)

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Target WordPress URL (e.g., http://192.168.100.74:888/wordpress)
  -U USERNAME, --username USERNAME
                        WordPress username
  -P PASSWORD, --password PASSWORD
                        WordPress password
  -p PLUGIN, --plugin PLUGIN
                        Plugin to install (default: All In One Woo Cart)

1. Clone the Repository:

   root@kitploit:~

   git clone https://github.com/Nxploited/CVE-2024-10674.git
   cd CVE-2024-10674
   

2. Install Dependencies: Ensure you have requests library installed. If not, install it using pip:

   root@kitploit:~

   pip install requests
   

3. Run the Exploit:

   root@kitploit:~

   python exploit_script.py --url <target-url> --username <wp-username> --password <wp-password> --plugin <plugin-name>
   

   Example:

   root@kitploit:~

   python exploit_script.py --url http://192.168.100.74:888/wordpress --username admin --password admin --plugin hello-dolly
   

   • --url: URL of the target WordPress site.
   • --username: WordPress username with at least Subscriber-level access.
   • --password: Password for the WordPress username.
   • --plugin: The plugin to be installed and activated (default: ).

📊 Output

The exploit script will provide the following output:

• Confirmation if the site is vulnerable.
• Successful login message.
• Nonce extraction for plugin installation and activation.
• Confirmation of plugin installation and activation.

⚠️ Disclaimer

This exploit is provided for educational purposes only. Use it at your own risk. The author is not responsible for any damage caused by the use of this exploit.

👨‍💻 Author

• Khaled Alenazi (Nxploit)

For any inquiries, you can contact me on GitHub.