CVE-2025-3605

This exploit targets a privilege escalation vulnerability in the WordPress Frontend Login and Registration Blocks plugin (CVE-2025-3605). It allows an attacker to change the email address of a target user (default: admin) by sending a crafted POST request to admin-ajax.php, enabling password reset via the new email.

This is a functional exploit for CVE-2025-3605, targeting a privilege escalation vulnerability in the Frontend Login and Registration Blocks WordPress plugin. It allows unauthenticated attackers to change the administrator's email via an AJAX endpoint, enabling password reset and account takeover.

This repository contains a functional Python exploit for CVE-2025-3605, targeting a privilege escalation vulnerability in the Frontend Login and Registration Blocks WordPress plugin (versions <= 1.0.7). The exploit allows unauthenticated attackers to change the administrator's email via an insecure AJAX endpoint, enabling password reset and account takeover.

The repository contains functional exploit code for CVE-2025-3605, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.