Nxploited/CVE-2025-49901

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based exploit targeting CVE-2025-49901, an authentication bypass in the WordPress Simple Link Directory plugin. It automates the full attack chain: locating the vulnerable password reset form, extracting a nonce, enumerating usernames, resetting passwords for discovered accounts, and then verifying administrative access via both session cookie checks and direct login attempts.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that automates exploitation of CVE-2025-49901, an authentication bypass in the WordPress Simple Link Directory plugin. It locates vulnerable reset pages, extracts nonces, enumerates users, resets passwords to a hardcoded value, and verifies admin access. No concealed executable payload, unrelated remote access, persistence mechanism, or operator-directed harm beyond the stated exploit was observed. The script writes successful credentials to a local file and does not exfiltrate data or establish backdoor access.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPressSimple Link Directory plugin (qc-simple-link-directory)
Attack typesAuthentication BypassPassword ResetPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively performs the full attack chain: it locates the vulnerable endpoint, extracts a nonce, enumerates users, resets their passwords, and then verifies administrative access. This constitutes exploitation, not just detection or scanning. The README explicitly describes it as an 'Authentication Bypass → Password Reset → RCE' attack flow.

README.md:6CVE-2025-49901.py:488-530CVE-2025-49901.py:613-674

Requirements

  • A target running a vulnerable version of the WordPress Simple Link Directory plugin (< 14.8.1).README.md:27
  • A list of target URLs provided in a file.CVE-2025-49901.py:816

Observed behavior

  • Locates the vulnerable password reset page by probing a list of common paths and checking for specific HTML content.CVE-2025-49901.py:351-406
  • Extracts a WordPress nonce from the page's HTML or JavaScript to use in the password reset request.CVE-2025-49901.py:254-302
  • Enumerates valid WordPress usernames via author archives, the REST API, and domain name heuristics.CVE-2025-49901.py:418-485
  • Sends a crafted POST request to the reset endpoint to change the password for each enumerated user to a fixed value.CVE-2025-49901.py:488-530
  • Verifies successful exploitation by checking for an authenticated session cookie and access to WordPress admin pages.CVE-2025-49901.py:533-589
  • Attempts a direct login with the newly set password as a secondary verification method.CVE-2025-49901.py:613-674
  • Logs successfully compromised accounts to an output file.CVE-2025-49901.py:757-761
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Password
newhackerpass123The password injected into target accounts during the reset flow, defined at line 64 and used in reset and login functions.CVE-2025-49901.py:64CVE-2025-49901.py:499CVE-2025-49901.py:706
Output File Path
scan_results/reset_mass_success.txtLocal file where verified credentials are written; no network exfiltration.CVE-2025-49901.py:65CVE-2025-49901.py:710-711CVE-2025-49901.py:760-761
Author Contact
Nxploited, GitHub: https://github.com/Nxploited, Telegram: @KNxploitedAuthor identification in script banner and README; no malicious behavior associated.CVE-2025-49901.py:4-6CVE-2025-49901.py:74README.md:158-162
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence, but its content is not material to the classification.
  • The evidence coverage is complete for the selected text files, but the artifact's binary policy is 'FLAGGED_METADATA_ONLY_NOT_ANALYZED', indicating no binary files were present.
  • One file (unclassified, 1505 bytes) was omitted from text analysis per binary policy; its metadata-only inclusion does not indicate a backdoor, but its content was not reviewed.
  • The review is limited to the supplied text evidence and does not assess the safety of executing the script or the legality of its use.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1