Nxploited/CVE-2025-6389

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that exploits CVE-2025-6389, an unauthenticated remote code execution vulnerability in the Sneeit Framework WordPress plugin. It sends a test payload using var_dump to confirm the vulnerability, then sends an exploit payload using wp_insert_user to create a new administrator account on the target.

Backdoor review

No backdoor observed in reviewed code

The PoC exploit script (CVE-2025-6389.py) and its README documentation implement a straightforward, publicly described remote code execution exploit for CVE-2025-6389. The script sends a test payload using var_dump, then exploits the vulnerability by calling wp_insert_user to create an administrator account with a hardcoded password. No concealed backdoor, unrelated payload, persistence mechanism, or deceptive behavior was observed. The code matches the documented exploit chain and does not perform any actions beyond the stated vulnerability exploitation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareSneeit FrameworkWordPress
Attack typesRemote Code ExecutionPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script CVE-2025-6389.py contains code that actively exploits the vulnerability by sending a payload to create an administrative user on the target system, which is the definition of an exploit.

CVE-2025-6389.py:135-141CVE-2025-6389.py:108-146

Requirements

  • Target must be running a vulnerable version of the Sneeit Framework plugin (<= 8.3) on WordPress.README.md:42
  • The target's admin-ajax.php endpoint must be reachable.CVE-2025-6389.py:114

Observed behavior

  • Sends a POST request to /wp-admin/admin-ajax.php with action=sneeit_articles_pagination, callback=var_dump, and args=['test'] to test for vulnerability.CVE-2025-6389.py:117-123
  • If the test response contains 'array(1)', '[0]', and '"test"', the target is considered vulnerable.CVE-2025-6389.py:100-103
  • Sends a second POST request to the same endpoint with callback=wp_insert_user and arguments to create a new WordPress administrator account with a hardcoded password.CVE-2025-6389.py:135-141
  • Logs successful exploits to success_results.txt with the target URL, username, password, and email.CVE-2025-6389.py:87-92
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Script sends test payload with callback=var_dump and args=["test"] to confirm vulnerability, then sends exploit payload with callback=wp_insert_user to create an admin user.This is the documented exploit chain for CVE-2025-6389 and matches the vulnerability description.CVE-2025-6389.py:116-146
Hardcoded Credentials
PASSWORD = "xplpass"The password for the created admin account is hardcoded and documented in the README. This is part of the exploit, not a hidden backdoor.CVE-2025-6389.py:47
Output File
success_results.txtSuccessful exploits are logged to a local file. This is expected behavior for a PoC tool and does not indicate exfiltration to an external server.CVE-2025-6389.py:48CVE-2025-6389.py:87-92
Review boundaries

What the analysis did not establish

  • One file (list.txt) was omitted from the evidence packet, so its contents are unknown.
  • The evidence packet reports complete_artifact_coverage is false, indicating not all repository files were included.
  • One file (unclassified_bytes: 1505) was present in the repository but not included as text; its content is unknown. However, the exploit logic is fully contained in the provided text files, and the missing file is not referenced by the script.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1