Nxploited/CVE-2025-53580

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2025-53580 that performs unauthenticated password reset on WordPress Simple Business Directory Pro < 15.6.9 by sending POST requests to the SBD restore form with qcpd-uid and a new password, then logs in and verifies admin access.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2025-53580.py implements a privilege escalation exploit for CVE-2025-53580 by resetting passwords via an unauthenticated SBD restore form and then logging in. No backdoor, concealed payload, or operator-directed harm beyond the stated exploit behavior was observed. The script writes successful login hits to a local file and uses a fixed password, but this is part of the documented exploit flow, not a hidden backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareWordPress Simple Business Directory Pro
Attack typesprivilege escalationauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits CVE-2025-53580 by sending crafted POST requests to reset user passwords without authentication, then authenticates with the new password and verifies administrative access. It does not merely detect or report the vulnerability; it performs the full privilege escalation chain.

CVE-2025-53580.py:249-272CVE-2025-53580.py:274-303README.md:40-66

Requirements

  • Target running Simple Business Directory Pro plugin version < 15.6.9 with exposed SBD restore pageCVE-2025-53580.py:229-247README.md:33-34

Observed behavior

  • Discovers SBD restore page by probing 24 candidate paths and checking for 'sbd' in response bodyCVE-2025-53580.py:229-247
  • Resets passwords for user IDs 1-3 by POSTing qcpd-restore-pwd, qcpd-uid, and pass parameters to the restore URLCVE-2025-53580.py:249-272
  • Enumerates usernames via author parameter redirects, REST API, and hostname heuristicsCVE-2025-53580.py:165-227
  • Logs into WordPress with the injected password and verifies admin access via REST API and dashboard markersCVE-2025-53580.py:274-357
  • Writes confirmed successful logins with admin status to an output fileCVE-2025-53580.py:359-375
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Fixed Password
NxploitedNXThe script resets user passwords to a hardcoded value (line 38) and uses it for login (line 262, 285). This is the documented exploit mechanism, not a hidden backdoor.CVE-2025-53580.py:38CVE-2025-53580.py:262CVE-2025-53580.py:285
Output File
Nx_sbd_login_hits.txtSuccessful login hits are written to a local file (line 36, 364-375). This is part of the exploit's reporting, not a backdoor.CVE-2025-53580.py:36CVE-2025-53580.py:364-375
Network Requests
POST to restore URL and wp-login.php, GET to REST API and wp-adminAll network requests are directed at the target site to perform the documented exploit steps (password reset, login, admin verification). No external or unrelated endpoints are contacted.CVE-2025-53580.py:249-272CVE-2025-53580.py:274-303CVE-2025-53580.py:305-321CVE-2025-53580.py:323-357
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) omitted from text content; metadata only
  • Evidence coverage is complete for the two provided text files
  • One file (requirements.txt) was omitted from the text evidence; its content is not reviewed.
  • Binary files were not present in the evidence.
  • The review is limited to the supplied text files; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1