Nxploited/CVE-2025-29009

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-29009, an unauthenticated arbitrary file upload vulnerability in the WordPress Medical Prescription Attachment Plugin for WooCommerce. It extracts a nonce from the target's frontend, uploads a user-supplied PHP web shell, verifies the shell by checking for a signature string, and saves the shell URL.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2025-29009. It uploads a user-supplied PHP shell to a vulnerable WordPress plugin endpoint and verifies the upload by checking for a user-supplied signature string. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed in the reviewed text files.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPressMedical Prescription Attachment Plugin for WooCommerce
Attack typesArbitrary File UploadWeb Shell Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively uploads a user-provided PHP web shell to a vulnerable target, verifies its presence, and saves the URL for later use. This constitutes exploitation, not mere detection or scanning. The README explicitly describes the attack flow as 'Upload shell' and 'Verify shell'.

CVE-2025-29009.py:216-283README.md:49-61

Requirements

  • Target running vulnerable Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3README.md:2
  • User-supplied PHP web shell file present on local filesystemCVE-2025-29009.py:105-108
  • Target's frontend exposes wkwcpaFrontObj JavaScript object containing ajaxUrl and ajaxNonceREADME.md:34

Observed behavior

  • Reads target URLs from a file and enqueues them for multithreaded processingCVE-2025-29009.py:118-132
  • Fetches frontend pages to extract the AJAX nonce from the wkwcpaFrontObj JavaScript objectCVE-2025-29009.py:143-179
  • Uploads a local PHP file via a multipart POST request to the extracted AJAX endpoint with action=wkwcpa_handle_prescription_session and type=uploadCVE-2025-29009.py:216-241
  • Parses the JSON response to extract the uploaded shell's public URLCVE-2025-29009.py:254-283
  • Verifies the uploaded shell by sending a GET request and checking for a user-defined signature string in the response bodyCVE-2025-29009.py:286-298
  • Saves verified shell URLs to shells.txtCVE-2025-29009.py:135-140
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a user-supplied PHP file to a target WordPress site via the wkwcpa_handle_prescription_session AJAX handler, then verifies the upload by checking for a user-supplied signature string in the response.This is the normal, stated behavior of the CVE-2025-29009 exploit. The script does not contain any hidden or unrelated actions.CVE-2025-29009.py:216-283CVE-2025-29009.py:286-298
User Interaction
The script prompts the user for a local shell filename and a unique shell signature, and uses these to perform the upload and verification.The script does not contain any hardcoded shell or backdoor; it relies entirely on user-provided files and strings.CVE-2025-29009.py:90-115
Output File
shells.txtThe script saves verified shell URLs to a local file named shells.txt. This is a standard output mechanism for an exploit scanner.CVE-2025-29009.py:135-140
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the text evidence; its content is not inspected.
  • The artifact's behavior is assessed solely from static source code analysis; the code was not executed.
  • One file (requirements.txt) was omitted from the text evidence; its content was not reviewed, but it is a standard Python dependency file and unlikely to contain executable backdoor logic.
  • Binary content was not present in the evidence.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1