CVE-2025-4796

This repository contains a functional exploit for CVE-2025-4796, a privilege escalation vulnerability in the Eventin WordPress plugin (<= 4.0.34). The exploit allows authenticated users (contributor+) to change any user's email via an insecure API endpoint, enabling account takeover.

The repository contains functional exploit code for CVE-2025-4796, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the exploit by uploading a file to a vulnerable endpoint and confirming its presence.

This is a functional exploit for CVE-2025-4796, targeting a WordPress vulnerability that allows privilege escalation by updating a speaker's email via an authenticated API request. The script automates login, nonce extraction, and payload delivery to escalate a user's privileges to admin.