xxconi/CVE-2025-6254

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that attempts to create a WordPress administrator account via the Doctreat Core plugin's AJAX registration handler (CVE-2025-6254). It sends crafted POST requests with a chosen role to wp-admin/admin-ajax.php, tries multiple action names and nonce values, and verifies the resulting admin access by logging in.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that exploits CVE-2025-6254 by sending HTTP requests to a target WordPress site to register an administrator user. All code is plain text with no obfuscation, no concealed payloads, and no operator-directed harm beyond the stated exploit behavior. The script performs only the described privilege escalation and optional admin login verification; it does not establish persistence, exfiltrate data, or execute unrelated commands.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareDoctreat Core WordPress plugin
Attack typesprivilege escalationunauthorized account creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests to create a new user with a specified role (default 'administrator') on a target WordPress site, and then verifies the resulting access by logging in. This constitutes exploitation, not mere detection or scanning.

CVE-2025-6254.py:180-211CVE-2025-6254.py:214-250

Requirements

  • Target must have a vulnerable version of the Doctreat Core plugin (<=1.6.8) installed and active, with the registration AJAX endpoint reachable.CVE-2025-6254.py:47-52CVE-2025-6254.py:88

Observed behavior

  • Generates random credentials (username, email, password) for a new user.CVE-2025-6254.py:98-103
  • Attempts to extract a nonce from common WordPress registration pages.CVE-2025-6254.py:105-127
  • Sends POST requests to wp-admin/admin-ajax.php with parameters including action, username, email, password, and a chosen role (default 'administrator'), iterating over multiple AJAX action names and nonce combinations.CVE-2025-6254.py:154-177CVE-2025-6254.py:193-209
  • If registration succeeds, attempts to log in to the WordPress admin panel with the created credentials to verify administrative access.CVE-2025-6254.py:214-250
  • Supports both single-target and mass-scanning modes, saving successful credentials to an output file.CVE-2025-6254.py:254-313CVE-2025-6254.py:361-398
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends POST requests to wp-admin/admin-ajax.php with role=administrator to create a privileged userMatches the CVE description of unauthenticated privilege escalation via doctreat_process_registration()CVE-2025-6254.py:154-177
Credential Generation
Generates random username/password/email for the new admin userStandard PoC practice to avoid hardcoded credentials; no evidence of exfiltrationCVE-2025-6254.py:98-103
Output File
Saves successful exploit results to a local file (default doctreat_vuln.txt)Local logging only; no network exfiltration observedCVE-2025-6254.py:77-82
Review boundaries

What the analysis did not establish

  • Only the Python script and README were provided; no network traffic or execution output is included.
  • The script's actual effectiveness against a live target cannot be confirmed from the static code alone.
  • Review is based solely on the supplied text files; no runtime behavior or network traffic was observed.
  • The script imports standard libraries only; no third-party dependencies were inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1