d3kc4rt1/CVE-2025-15260

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup detailing a missing authorization vulnerability (CVE-2025-15260) in the MyRewards WordPress plugin. It explains the root cause, provides a conceptual proof-of-concept with a curl command, and describes the impact, but does not include executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a known CVE (CVE-2025-15260) in the MyRewards WordPress plugin. It describes a missing authorization vulnerability, provides a technical explanation, and includes a proof-of-concept (PoC) curl command that exploits the vulnerability by sending a crafted AJAX request to modify loyalty point multipliers. The PoC targets the vulnerable plugin's own admin-ajax.php endpoint and performs the exact unauthorized action described in the CVE. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the documented exploit is present. The artifact is purely informational and contains no executable code.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdownphpjsonbash
Target softwareMyRewards – Loyalty Points and Rewards for WooCommerce
Attack typesbroken access controlprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis of CVE-2025-15260, including a root cause analysis, a conceptual proof-of-concept with a curl command, and remediation steps. It does not contain a standalone, executable script designed to automatically exploit or scan for the vulnerability; the curl command is illustrative within the writeup. Therefore, it is classified as a writeup.

README.md:1-103

Requirements

  • Target running WooCommerce with MyRewards v5.6.0.README.md:52
  • Valid credentials for a subscriber level account.README.md:53
  • A pre-configured reward system with an enumerable rule ID.README.md:54

Observed behavior

  • The writeup describes how an authenticated subscriber can send a crafted POST request to the admin-ajax.php endpoint to modify loyalty point multipliers.README.md:77-80
  • The server is expected to return a JSON status confirming the update.README.md:84
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://TARGET_SITE/wp-admin/admin-ajax.phpThe PoC curl command targets the WordPress admin-ajax.php endpoint of the vulnerable plugin, which is the expected target for the described missing authorization exploit.README.md:77
Base64 Encoded Payload
eyJwb3N0X2lkIjoiMTAxIiwid3JlX3R5cGUiOiJsd3Nfd29vcmV3YXJkc19ldmVudHNfb3JlZXJhbW91bnQiLCJsd3Nfd29vcmV3YXJkc19ldmVudHNfb3JlZXJhbW91bnRfbWVsdGlwbGl1ciI6ICI5OTk5OTk5OTk5OTk5OTk5In0The base64-encoded payload decodes to JSON that modifies a loyalty rule multiplier, consistent with the documented vulnerability. It is used in the PoC to demonstrate the exploit.README.md:70
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file; no executable source code files (e.g., .py, .sh) were provided.
  • The curl command is presented as an illustrative example within the writeup and is not a functional, self-contained exploit or scanner script.
  • Only the README.md file was provided; no other repository files were inspected. The analysis scope confirms no executable source code was identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1