Nxploited/CVE-2025-13342

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that scans for vulnerable ACF frontend forms and exploits CVE-2025-13342 by sending a crafted AJAX POST request to create an administrator account on the target WordPress site.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2025-13342.py) and its README.md. The script automates scanning for vulnerable ACF frontend forms and submitting a crafted payload to create an administrator user via AJAX. All behavior is consistent with the stated CVE-2025-13342 exploit: it discovers forms, maps fields, builds a payload with hardcoded credentials, and sends it to /wp-admin/admin-ajax.php. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential theft, or other backdoor indicators were observed in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareWordPressFrontend Admin by DynamiApps
Attack typesprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted HTTP POST request to create an administrator account on a remote target, which is the definition of an exploit. It does not merely detect or report the vulnerability; it exercises it to achieve unauthorized access.

CVE-2025-13342.py:391CVE-2025-13342.py:517-524README.md:36

Requirements

  • Target must have the vulnerable Frontend Admin by DynamiApps plugin (<= 3.28.20) installed and a public ACF frontend form accessible on a common registration path.README.md:28CVE-2025-13342.py:43-71

Observed behavior

  • Loads a list of target URLs from a user-specified file.CVE-2025-13342.py:171-177
  • Probes each target on a list of 28 common registration paths to find a page containing an ACF frontend form.CVE-2025-13342.py:43-71CVE-2025-13342.py:422-444
  • Parses the discovered form to extract hidden ACF fields (_acf_nonce, _acf_form) and map user input fields (username, email, password, role).CVE-2025-13342.py:214-290CVE-2025-13342.py:293-347
  • Constructs a POST payload that includes the mapped fields with hardcoded attacker credentials and sets the role field to 'administrator'.CVE-2025-13342.py:350-404CVE-2025-13342.py:557-559
  • Sends the crafted payload to /wp-admin/admin-ajax.php with action=frontend_admin/form_submit to create a new administrator user.CVE-2025-13342.py:501-524
  • Checks the response for 'success: true' and logs successful admin creations to acf_success.txt.CVE-2025-13342.py:407-419CVE-2025-13342.py:447-458
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
username=Nxadmin1, email=nxploitedtest@gmail.com, password=NxAdmin_1337#KSAThe exploit uses fixed credentials to create an administrator account on vulnerable targets. This is part of the normal exploit behavior described in the README and does not constitute a backdoor.CVE-2025-13342.py:557-559
Exploit Payload
POST to /wp-admin/admin-ajax.php with action=frontend_admin/form_submit and role=administratorThe script constructs and sends a payload to create an administrator user. This is the core exploit action and matches the CVE description.CVE-2025-13342.py:391CVE-2025-13342.py:401CVE-2025-13342.py:503
Success Logging
Writes successful admin creations to acf_success.txtThe script logs successful exploits locally. This is a standard operational feature for an exploit tool and does not indicate hidden data exfiltration.CVE-2025-13342.py:447-458
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the evidence packet due to text budget constraints, but its absence does not affect classification.
  • The evidence includes only the source code and README; no runtime output or network captures are provided to confirm successful exploitation.
  • One file (requirements.txt) was present in the repository but not included as text; only its metadata was provided. This file is typically a list of Python dependencies and is unlikely to contain backdoor behavior, but its content was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1