CVE-2025-5288

CRITICAL

WP plugin <2.0.3 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-5288. PoCs published by Nxploited, Boshe99.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-5288, an unauthenticated privilege escalation vulnerability in the 'REST API | Custom API Generator For Cross Platform And Import Export In WP' WordPress plugin. The exploit sends a crafted JSON payload to create an administrator account via a missing capability check in the `process_handler()` function.

Description

The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.

Exploits (2)

nomisec WORKING POC 3 stars
by Nxploited · poc
https://github.com/Nxploited/CVE-2025-5288

This repository contains a functional exploit for CVE-2025-5288, an unauthenticated privilege escalation vulnerability in the 'REST API | Custom API Generator For Cross Platform And Import Export In WP' WordPress plugin. The exploit sends a crafted JSON payload to create an administrator account via a missing capability check in the `process_handler()` function.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: REST API | Custom API Generator For Cross Platform And Import Export In WP (versions 1.0.0 to 2.0.3)
No auth needed
Prerequisites: Target must have the vulnerable plugin installed and active · Attacker must be able to send HTTP requests to the target WordPress site
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2025-5288

The repository contains functional exploit code for CVE-2025-5288, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin 3DPrint Lite 1.9.1.4
No auth needed
Prerequisites: target URL · file path to upload
devstral-2 · analyzed Feb 27, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.0053
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-862
Status published
Products (1)
weboccults/REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3
Published Jun 13, 2025
Tracked Since Feb 18, 2026