Jenderal92/WP-CVE-2025-6934

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python 2 script that exploits CVE-2025-6934 by sending crafted registration requests to the Opal Estate Pro WordPress plugin, attempting to create a new user with the 'administrator' role without authentication.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python 2 script that exploits CVE-2025-6934 by sending crafted registration requests to a vulnerable WordPress plugin. The code performs only the advertised privilege escalation: it extracts a nonce, constructs POST requests with a hardcoded 'administrator' role, and saves successful credentials locally. No concealed payload, persistence mechanism, credential exfiltration to a remote server, or unrelated behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareOpal Estate Pro – Property Management and Submission WordPress plugin
Attack typesprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests to create a new user with the 'administrator' role on a vulnerable WordPress site, which constitutes exploitation rather than mere detection or scanning.

CVE-2025-6934.py:106-225README.md:6

Requirements

  • Target must be running a vulnerable version (<= 1.7.5) of the Opal Estate Pro plugin with the registration endpoint exposed.CVE-2025-6934.py:1
  • Attacker must provide a list of target URLs in a file.CVE-2025-6934.py:252

Observed behavior

  • Fetches the target homepage to extract a registration nonce from an input field or inline script.CVE-2025-6934.py:65-101
  • Sends POST requests to wp-admin/admin-ajax.php with action 'opalestate_register_form' and a payload that includes 'role': 'administrator' to create a new administrator account.CVE-2025-6934.py:126-164
  • Checks the response for success indicators (JSON status true or keywords like 'success', 'registered') and saves the created credentials to vulns.txt.CVE-2025-6934.py:173-206
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Save
vulns.txtSuccessful exploit credentials are appended to a local file 'vulns.txt' in the working directory. This is consistent with the stated purpose of recording vulnerable targets and does not indicate exfiltration.CVE-2025-6934.py:227-234
Hardcoded Password
Shincode123#$The script uses a fixed password for all registration attempts. This is a weak operational choice but does not constitute a backdoor or hidden payload.CVE-2025-6934.py:116
Review boundaries

What the analysis did not establish

  • Evidence is limited to static source code analysis; the script was not executed, and its effectiveness or safety is not verified.
  • The README references an external image and disclaimer link that were not provided in the evidence.
  • The review is based solely on the supplied text files; no runtime behavior or external dependencies were analyzed.
  • The script is written in Python 2, which is end-of-life, but this does not by itself indicate malicious intent.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1