Khaled Alenazi (Nxploited)
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitWordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE
Metasploit exploitby Emiliano Versini, plus 2 additional contributorsAdded to Metasploit 2025-11-23ExploitCVE-2025-117491 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-11749 in the WordPress AI Engine plugin (<= 3.1.3) by extracting a bearer token from the REST API, using it to create an administrator account via the MCP endpoint, and then uploading and executing a malicious plugin to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard exploit chain for CVE-2025-11749: unauthenticated admin user creation via the MCP endpoint, followed by authenticated plugin upload for RCE. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively creates an administrator account and uploads a payload to execute arbitrary code on the target. It is not a scanner, writeup, or stub.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:1-290Requirements
- Target must be running WordPress with the AI Engine plugin version <= 3.1.3 and the MCP endpoint must expose a bearer token.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:25-27modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:92-96
Observed behavior
- Checks if the target is a vulnerable WordPress instance by verifying the AI Engine plugin version and extracting the MCP token from the REST API routes.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:89-98 - Creates a new WordPress administrator account via the MCP endpoint using the extracted token, or updates the password if the user already exists.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:111-117modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:251-258 - Logs in with the created administrator credentials, uploads a malicious plugin containing the payload, and triggers its execution to achieve remote code execution.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:119-126modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:277-289
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe module's exploit method (lines 101-127) first creates an admin user via the MCP API, then logs in and uploads a malicious plugin to execute a payload. This matches the stated description and CVE context.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:101-127 - Payload Execution
- Payload withheldThe upload_and_execute_payload method (lines 277-289) generates a plugin containing the payload, uploads it using the admin cookie, and triggers execution by requesting the payload file. This is standard Metasploit RCE behavior.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:277-289 - Cleanup Registration
- Payload withheldLines 284-285 register the uploaded plugin files and directory for cleanup, which is standard practice for Metasploit modules with side effects.
modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:284-285
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The artifact was not executed; classification is based on static analysis of the provided Ruby source.
- Only the module source file was reviewed; Metasploit framework mixins (e.g., Msf::Exploit::Remote::HTTP::Wordpress, Msf::Payload::Php) and the generate_plugin method are not expanded in the evidence.
- The actual payload executed (e.g., meterpreter) is selected at runtime by the Metasploit user and is not part of this artifact's source.
- Binary files were not inspected per the evidence policy (FLAGGED_METADATA_ONLY_NOT_ANALYZED), though no binary files were present in this packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.