Nxploited/CVE-2025-68001

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A multi-threaded Python script that exploits CVE-2025-68001, an unauthenticated arbitrary file upload vulnerability in the WordPress g-FFL Checkout plugin, to upload a web shell and achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Python script and README implement a straightforward, unauthenticated arbitrary file upload exploit against the g-FFL Checkout WordPress plugin (CVE-2025-68001). The code performs only the described exploit steps: fetching a checkout page, extracting a nonce, uploading a user-supplied file via the vulnerable AJAX endpoint, and logging results. No hidden network calls, persistence mechanisms, credential exfiltration, or unrelated payloads were observed. The script's behavior is fully transparent and consistent with a public proof-of-concept exploit.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareWordPress g-FFL Checkout plugin
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a user-supplied file to a target server via the vulnerable AJAX endpoint, which is the core action of exploiting the vulnerability. It does not merely detect or report the vulnerability; it performs the file upload to achieve remote code execution.

CVE-2025-68001.py:181-245README.md:30-32

Requirements

  • A target running a vulnerable version (<= 2.1.0) of the g-FFL Checkout WordPress plugin.README.md:2
  • A PHP web shell file to upload.CVE-2025-68001.py:98-101
  • A list of target URLs.CVE-2025-68001.py:92-95

Observed behavior

  • Fetches the /checkout page to extract a nonce.CVE-2025-68001.py:148-152
  • Sends a POST request to /wp-admin/admin-ajax.php with action=ffl_upload_document, the extracted nonce, and the shell file disguised as image/png.CVE-2025-68001.py:209-220
  • Parses the JSON response to extract the uploaded file path.CVE-2025-68001.py:224-245
  • Writes successful exploit results (target URL, file path, filename) to success_results.txt.CVE-2025-68001.py:133-135CVE-2025-68001.py:306-307
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a user-supplied file to a target WordPress site via the ffl_upload_document AJAX actionThis is the core exploit functionality matching the CVE description. The script reads a shell file from disk and sends it as a multipart POST to /wp-admin/admin-ajax.php.CVE-2025-68001.py:181-245
File Operation
Writes successful exploit results to success_results.txtThe script appends target URL, file path, and filenames to a local results file. This is expected logging for a PoC tool.CVE-2025-68001.py:133-135CVE-2025-68001.py:306-307
Network Communication
Makes HTTP GET to /checkout and POST to /wp-admin/admin-ajax.php on target sitesAll network requests are directed at the user-supplied target list and are necessary for the exploit. No calls to external C2, telemetry, or unrelated services are present.CVE-2025-68001.py:138-154CVE-2025-68001.py:196-220
User Interaction
Prompts user for target list file, shell file path, and thread countThe script requires explicit user input for the shell file to upload, confirming it does not bundle or fetch a hidden payload.CVE-2025-68001.py:92-116
Review boundaries

What the analysis did not establish

  • One file (shell.php) is reported in the repository but its content is not included in the evidence.
  • The evidence does not include the execution output or verification that the exploit was successful.
  • One file (1505 bytes, unclassified) was present in the repository but not included as text; its metadata was reported but content was not analyzed. The reviewed Python script does not import or reference this file, and no evidence links it to the exploit's runtime behavior.
  • The review does not assess the safety or legality of the user-supplied shell file; the script merely uploads whatever file the user provides.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1