Nxploited/CVE-2025-14364

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to WordPress as a Subscriber, extracts a nonce, and sends a crafted AJAX request to trigger a full site reset via the Demo Importer Plus plugin, escalating privileges to Administrator.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script and README implement a PoC for CVE-2025-14364 (Demo Importer Plus privilege escalation). The code performs WordPress registration, login, nonce extraction, and an AJAX call to trigger a site reset. No concealed backdoor, unrelated payload, credential exfiltration to an external party, or persistence mechanism was observed. All network activity is directed at the user-supplied target list, and all file writes are local diagnostic logs.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareWordPressDemo Importer Plus plugin
Attack typesprivilege escalationdata destruction
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's Mode 3 (exploit mode) actively sends a crafted request to the vulnerable AJAX endpoint to trigger a site reset and privilege escalation, which constitutes exploitation, not just detection or scanning.

CVE-2025-14364.py:419-470README.md:57-65

Requirements

  • A valid WordPress subscriber account with activated credentials.CVE-2025-14364.py:435README.md:55
  • Target must have the vulnerable Demo Importer Plus plugin (<= 2.0.8) installed.README.md:34

Observed behavior

  • Authenticates to WordPress using supplied credentials via /wp-login.php.CVE-2025-14364.py:213-272
  • Extracts a WordPress REST nonce from the /wp-admin/ page source.CVE-2025-14364.py:275-360
  • Sends a POST request to /wp-admin/admin-ajax.php with action=demo_importer_plus and payload {"demo_action":"do-reinstall"} to trigger a full site reset.CVE-2025-14364.py:363-416
  • Logs successful exploitation, recording the target URL and credentials with admin privileges.CVE-2025-14364.py:447-449
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Activity
All HTTP requests target user-supplied hosts from list.txt; no hardcoded external C2 or exfiltration endpoints.Demonstrates that the tool only interacts with the intended WordPress targets.CVE-2025-14364.py:129-138CVE-2025-14364.py:141-210CVE-2025-14364.py:363-416CVE-2025-14364.py:419-470
File Write
Writes results to local files: diagnostics_results.txt, passed_targets.txt, register_results.txt, exploit_results.txt, reset_results.txt.Logging is local and transparent; no evidence of exfiltration or hidden file operations.CVE-2025-14364.py:21-25CVE-2025-14364.py:71-81CVE-2025-14364.py:180-193CVE-2025-14364.py:244-257CVE-2025-14364.py:401CVE-2025-14364.py:448-449
Credential Handling
Default credentials (Nxploited / NxploitedSA) are used only for WordPress registration and login against the target list; they are not sent to any third party.Credentials are used solely for the intended exploit flow.CVE-2025-14364.py:38-39CVE-2025-14364.py:213-272CVE-2025-14364.py:419-470
Review boundaries

What the analysis did not establish

  • One file (requirements.txt) was omitted from the packet; its content is not available for analysis.
  • The artifact contains a binary file (unclassified) that was not analyzed.
  • One file (requirements.txt, 1505 bytes) was flagged as binary and not analyzed; it is a standard pip requirements file and unlikely to contain executable backdoor logic.
  • The review does not assess the safety of the exploit itself (site reset) on authorized targets; it only evaluates whether the PoC contains hidden backdoor behavior against the operator.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1