WordPress Plugin 5.2.0 - Broken Access Control

ExploitDBExploitDB exploitWriteupEDB-52511

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a broken access control vulnerability in the WordPress Highlight and Share plugin <= 5.2.0. It explains the vulnerability, required privileges, and provides a manual proof-of-concept using captured nonce and curl commands, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a plaintext description of a broken access control vulnerability and a curl-based proof-of-concept. It contains no executable code, no obfuscation, and no instructions for the reviewer to perform any action beyond sending a crafted HTTP request to a target WordPress site. The PoC demonstrates the claimed vulnerability without any concealed or deceptive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareWordPress Highlight and Share plugin
Attack typesBroken Access ControlUnauthorized Email Sending
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a textual description of a vulnerability and a manual proof-of-concept using curl commands. It does not contain any executable code, automated exploitation script, or scanning logic. The file is a writeup, not an exploit or scanner.

exploits/multiple/webapps/52511.go:1-64

Requirements

  • Target website must have vulnerable Highlight and Share plugin (<= 5.2.0) installed.exploits/multiple/webapps/52511.go:1
  • Attacker must obtain a valid nonce by capturing a legitimate 'Share via Email' request from a public post.exploits/multiple/webapps/52511.go:26-34

Observed behavior

  • The writeup describes sending an unauthenticated POST request to wp-admin/admin-ajax.php with action 'has_email_form_submission' and captured nonce to trigger email sharing.exploits/multiple/webapps/52511.go:40-49
  • The expected response is a JSON object indicating successful email sharing without authentication.exploits/multiple/webapps/52511.go:52-63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Unauthenticated AJAX action 'has_email_form_submission' in WordPress plugin Highlight and Share <= 5.2.0 allows email spam via reused nonce.The PoC describes how to exploit CVE-2025-67586 by sending a crafted POST request to admin-ajax.php.exploits/multiple/webapps/52511.go:10-16
Proof Of Concept Command
curl -s -i -X POST 'http://localhost/wp-admin/admin-ajax.php' -d 'action=has_email_form_submission' ...The PoC demonstrates the vulnerability by sending an unauthenticated email sharing request. It targets the stated vulnerable plugin and does not include any backdoor or unrelated payload.exploits/multiple/webapps/52511.go:40-49
Review boundaries

What the analysis did not establish

  • Only the supplied text file was reviewed; no external resources, binaries, or network content were fetched or analyzed.
  • The artifact is a plaintext description; no executable code was present to analyze for hidden behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1