Nxploited/CVE-2025-15030

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python tool that exploits CVE-2025-15030 in the User Profile Builder WordPress plugin to perform unauthenticated password resets, gain admin access, and deploy a web shell.

Backdoor review

No backdoor observed in reviewed code

The PoC implements the disclosed CVE-2025-15030 exploit: unauthenticated password reset for WordPress User Profile Builder. It performs password resets, username enumeration, admin login verification, and optional shell upload via a local Nxploited.zip file. All actions are directed at the operator-supplied target list. No concealed, unrelated, or operator-misrepresented harmful behavior was found. The shell upload is a disclosed post-exploitation step, not a backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareUser Profile Builder WordPress plugin
Attack typesaccount takeoverweb shell upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that actively resets passwords, logs into WordPress admin accounts, and deploys a web shell. The README describes it as implementing 'attack chains' for 'Admin Takeover + Shell Upload'. This is exploitation, not detection or scanning.

README.md:4README.md:43-68CVE-2025-15030.py:619-681CVE-2025-15030.py:413-566

Requirements

  • Target WordPress site with vulnerable User Profile Builder plugin (< 3.15.2).README.md:31
  • A list of target URLs provided in a file.CVE-2025-15030.py:961
  • Optional: Nxploited.zip file in the script directory for shell upload.README.md:89

Observed behavior

  • Initiates an unauthenticated password reset for the 'admin' user via wp-login.php.CVE-2025-15030.py:619-681
  • Enumerates WordPress usernames via author archives, REST API, and hostname heuristics.CVE-2025-15030.py:218-240
  • Attempts to log in with the new password and verifies admin access by checking multiple /wp-admin/ pages.CVE-2025-15030.py:246-299
  • Exploits Profile Builder's recover_password2 action to reset passwords using a provided reset link.CVE-2025-15030.py:734-784
  • Uploads a malicious plugin (Nxploited.zip) or writes a PHP shell via the plugin/theme editor after gaining admin access.CVE-2025-15030.py:413-566
  • Logs successful admin logins and deployed shell URLs to output files.CVE-2025-15030.py:593-600CVE-2025-15030.py:408-411
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Fixed Password
Nxploited_adminSAHardcoded password used for all password reset and login attempts against operator-supplied targets.CVE-2025-15030.py:968
Shell Upload
Nxploited.zipThe script attempts to upload a local Nxploited.zip plugin to compromised targets to deploy a webshell at /wp-content/plugins/Nxploited/Nx.php. This is a disclosed post-exploitation action.CVE-2025-15030.py:388-406CVE-2025-15030.py:413-566
Output File
scan_results/shells.txtSuccessful shell deployments are logged locally with target URL, credentials, and shell path.CVE-2025-15030.py:408-411
Review boundaries

What the analysis did not establish

  • One file (Nxploited.zip) is binary and was not analyzed; its contents are unknown.
  • The evidence packet reports complete_artifact_coverage is false, indicating not all repository files were included.
  • The contents of the binary file Nxploited.zip were not inspected; only its metadata and usage in the script were reviewed.
  • The review assumes the operator intends to use the tool against authorized targets; the tool's offensive nature is inherent to the disclosed CVE exploit.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1