CVE-2025-15403 Exploit Metadata

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A Python exploit suite for CVE-2025-15403 that performs unauthenticated privilege escalation in the RegistrationMagic WordPress plugin. It includes modes for user registration, sending the exploit primitive (AJAX request to poison admin_order), and a full chain that logs in, verifies admin dashboard access, and uploads a test plugin to confirm remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python exploit suite for CVE-2025-15403, a privilege escalation vulnerability in the RegistrationMagic WordPress plugin. The code performs unauthenticated AJAX option poisoning, user registration, login, and verification of admin access including a benign test plugin upload. No concealed backdoor, unrelated payload, credential exfiltration, or persistence mechanism was observed. The plugin upload creates a harmless 'Nxploited' test plugin solely to confirm RCE capability and does not deploy a malicious payload.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareRegistrationMagic WordPress plugin

Attack typesprivilege escalationremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable Python code that actively sends the exploit primitive (AJAX request to poison admin_order), registers users, logs in, and uploads a plugin to achieve RCE. This is code intended to exercise the vulnerability, not merely detect it.

CVE-2025-15403.py:414-432CVE-2025-15403.py:544-601

Requirements

Target WordPress site running RegistrationMagic plugin version <= 6.0.7.1README.md:42
Python 3.8+ with requests, colorama, urllib3 installedREADME.md:168

Observed behavior

Sends unauthenticated POST request to /wp-admin/admin-ajax.php with action=rm_user_exists and order=,menu1 to poison the rm_admin_order optionCVE-2025-15403.py:414-432
Registers a new WordPress subscriber account via smart form detection on registration pagesCVE-2025-15403.py:332-384
Logs in with the escalated subscriber account and verifies admin dashboard access, plugin install page access, and uploads a test plugin to confirm RCECVE-2025-15403.py:635-727

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Unauthenticated AJAX call to poison rm_admin_order optionCore exploit primitive targeting the stated CVE-2025-15403 vulnerability.CVE-2025-15403.py:414-432
Exploit Behavior: User registration via smart form detectionMode 0 functionality to create a subscriber account for privilege escalation.CVE-2025-15403.py:332-384
Exploit Behavior: Admin dashboard and plugin install page verificationMode 2 verification that escalated privileges grant admin access.CVE-2025-15403.py:457-510
Exploit Behavior: Test plugin upload and execution checkUploads a benign 'Nxploited' plugin to confirm RCE; the plugin only echoes 'Nxploited'.CVE-2025-15403.py:519-535CVE-2025-15403.py:544-601
Output File: rm_plugin_rce_success.txtLogs successful plugin uploads for verification; does not exfiltrate data.CVE-2025-15403.py:623-629

Review boundaries

What the analysis did not establish

One file (list.txt) is omitted from the evidence; its content is not available for analysis.
The evidence packet reports complete_artifact_coverage as false, indicating not all repository files are included.
One file (list.txt) was omitted from the evidence packet; it is a user-supplied target list and not part of the exploit code.
Binary content was not analyzed, but no binary files were identified in the artifact.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2025-15403