MataKucing-OFC

GitHub · Repository owner · Source ID 72303820
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

MataKucing-OFC/CVE-2025-13486

Repository PoC2Created 2025-12-05ExploitCVE-2025-134862 files

15.5 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-13486 in Advanced Custom Fields: Extended plugin to create an administrative user on vulnerable WordPress sites via an unauthenticated AJAX request.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2025-13486.py) and README.md implement and document a straightforward exploit for CVE-2025-13486. The script sends crafted POST requests to a vulnerable WordPress plugin to create an administrator user via wp_insert_user. No concealed backdoor, unrelated payload, credential exfiltration, persistence mechanism, or deceptive behavior was observed. The code is fully readable and contains no obfuscation or hidden functionality.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPressAdvanced Custom Fields: Extended
Attack typesremote code executionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits the vulnerability by sending crafted HTTP requests to create an administrative user on the target. The README describes it as a 'Mass Exploit' and the code includes an 'exploit_single' function that performs the exploitation.

CVE-2025-13486.py:69-96README.md:1

Requirements

  • Target must run a vulnerable version (0.9.0.5 - 0.9.1.1) of the Advanced Custom Fields: Extended plugin.README.md:6
  • The target's admin-ajax.php endpoint must be reachable.CVE-2025-13486.py:32

Observed behavior

  • Sends a POST request to /wp-admin/admin-ajax.php with action 'acfe/form/render_form_ajax' and form parameters that call wp_insert_user to create a new administrator account.CVE-2025-13486.py:88-99
  • Optionally verifies vulnerability by calling print_r with a random marker and checking the response.CVE-2025-13486.py:44-63
  • Supports mass exploitation by reading a list of targets and using threading.CVE-2025-13486.py:289-296
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented exploit for CVE-2025-13486 and matches the CVE description.CVE-2025-13486.py:88-96
Default Credentials
Payload withheldThese are hardcoded default credentials used when the user does not supply custom values. They are part of the exploit payload, not a backdoor.CVE-2025-13486.py:227-229
Output File Creation
Payload withheldThis is standard logging for a PoC tool and does not indicate hidden data exfiltration.CVE-2025-13486.py:230CVE-2025-13486.py:351-355
Review boundaries

What the analysis did not establish

  • Evidence is limited to the provided source code; no runtime behavior or network traffic was observed.
  • The script disables SSL verification (verify=False), which may mask TLS-related issues in a real environment.
  • Only the two text files (CVE-2025-13486.py and README.md) were reviewed; no other files exist in the repository snapshot.
  • The review does not assess the safety of executing the script against authorized targets, only the absence of backdoor behavior within the script itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

MataKucing-OFC/CVE-2018-17254

Repository PoC0Created 2023-01-29Not analyzedCVE-2018-172542 files

12.9 KiB

GitHubPoC details