Nxploited/CVE-2025-2563

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based mass exploitation tool for CVE-2025-2563 that performs unauthenticated privilege escalation on WordPress sites running vulnerable versions of the User Registration & Membership plugin. It automatically discovers targets, registers a new user, injects an 'administrator' role via a vulnerable AJAX endpoint, and verifies admin access.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a straightforward WordPress privilege escalation exploit targeting CVE-2025-2563. It registers a user, injects an administrator role via an AJAX call, and verifies admin access. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed Python script or README.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareWordPressUser Registration & Membership plugin
Attack typesprivilege escalationunauthorized account creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary purpose is to exploit CVE-2025-2563 by actively creating an administrator account on vulnerable targets. The README describes it as a 'Proof-of-Concept (PoC) mass exploitation scanner' and the code implements a full attack chain: registration, role injection, and admin verification. The code contains the exploit payload ('role': 'administrator') and writes compromised credentials to a file.

README.md:43CVE-2025-2563.py:516CVE-2025-2563.py:555

Requirements

  • Target must run a vulnerable version (< 4.1.2) of the User Registration & Membership plugin with the Membership Addon enabled.README.md:2README.md:37
  • The target's membership registration pages must be accessible to extract nonces and form tokens.CVE-2025-2563.py:301-347

Observed behavior

  • Fetches membership pricing and registration pages to discover form tokens, nonces, and membership IDs.CVE-2025-2563.py:301-347
  • Registers a new user account via the user_registration_user_form_submit AJAX action, iterating through token combinations.CVE-2025-2563.py:350-413
  • Exploits the vulnerability by sending a crafted user_registration_membership_register_member AJAX request with 'role': 'administrator' to escalate privileges.CVE-2025-2563.py:490-569
  • Verifies the escalated privileges by logging into WordPress and checking for admin panel indicators.CVE-2025-2563.py:416-487
  • Writes successfully exploited admin credentials to an output file (Nx_admin.txt).CVE-2025-2563.py:107-114CVE-2025-2563.py:555
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Harvesting
Hardcoded password 'Nx_adminSA' used for all created accountsThe tool creates accounts with a fixed password, which could be used by the operator to access compromised sites. This is inherent to the exploit's purpose and not a hidden backdoor.CVE-2025-2563.py:30
File Write
Writes successful registrations to 'reg.txt' and admin escalations to 'Nx_admin.txt'The tool logs compromised credentials locally. This is expected behavior for a PoC exploit scanner and does not indicate exfiltration or hidden persistence.CVE-2025-2563.py:28-29CVE-2025-2563.py:97-114
Network Activity
Sends HTTP requests to target WordPress sites to exploit CVE-2025-2563All network activity is directed at the user-supplied targets and is consistent with the described exploit chain. No calls to unrelated external servers were found.CVE-2025-2563.py:301-347CVE-2025-2563.py:350-413CVE-2025-2563.py:490-569
Review boundaries

What the analysis did not establish

  • One file (likely requirements.txt) was omitted from the text evidence due to being flagged as binary or unclassified, but its absence does not affect classification.
  • The evidence includes only the Python exploit script and README; no network captures or execution logs are provided to confirm the code's behavior at runtime.
  • One file (requirements.txt) was omitted from the text evidence; its content is not reviewed.
  • Binary files were not present in the evidence.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1