MataKucing-OFC/CVE-2025-13486

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-13486 in Advanced Custom Fields: Extended plugin to create an administrative user on vulnerable WordPress sites via an unauthenticated AJAX request.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2025-13486.py) and README.md implement and document a straightforward exploit for CVE-2025-13486. The script sends crafted POST requests to a vulnerable WordPress plugin to create an administrator user via wp_insert_user. No concealed backdoor, unrelated payload, credential exfiltration, persistence mechanism, or deceptive behavior was observed. The code is fully readable and contains no obfuscation or hidden functionality.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPressAdvanced Custom Fields: Extended
Attack typesremote code executionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits the vulnerability by sending crafted HTTP requests to create an administrative user on the target. The README describes it as a 'Mass Exploit' and the code includes an 'exploit_single' function that performs the exploitation.

CVE-2025-13486.py:69-96README.md:1

Requirements

  • Target must run a vulnerable version (0.9.0.5 - 0.9.1.1) of the Advanced Custom Fields: Extended plugin.README.md:6
  • The target's admin-ajax.php endpoint must be reachable.CVE-2025-13486.py:32

Observed behavior

  • Sends a POST request to /wp-admin/admin-ajax.php with action 'acfe/form/render_form_ajax' and form parameters that call wp_insert_user to create a new administrator account.CVE-2025-13486.py:88-99
  • Optionally verifies vulnerability by calling print_r with a random marker and checking the response.CVE-2025-13486.py:44-63
  • Supports mass exploitation by reading a list of targets and using threading.CVE-2025-13486.py:289-296
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends a POST request to /wp-admin/admin-ajax.php with action=acfe/form/render_form_ajax and form[render]=wp_insert_user to create an administrator account.This is the documented exploit for CVE-2025-13486 and matches the CVE description.CVE-2025-13486.py:88-96
Default Credentials
Default username 'nemesis', password 'Warga@Sipil1337', email 'youremail@domain.tld'These are hardcoded default credentials used when the user does not supply custom values. They are part of the exploit payload, not a backdoor.CVE-2025-13486.py:227-229
Output File Creation
The script writes results to 'success_results.txt' and 'successful_targets.txt'.This is standard logging for a PoC tool and does not indicate hidden data exfiltration.CVE-2025-13486.py:230CVE-2025-13486.py:351-355
Review boundaries

What the analysis did not establish

  • Evidence is limited to the provided source code; no runtime behavior or network traffic was observed.
  • The script disables SSL verification (verify=False), which may mask TLS-related issues in a real environment.
  • Only the two text files (CVE-2025-13486.py and README.md) were reviewed; no other files exist in the repository snapshot.
  • The review does not assess the safety of executing the script against authorized targets, only the absence of backdoor behavior within the script itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1