Exploitation Summary
EIP tracks 4 public exploits for CVE-2025-5701. PoCs published by RandomRobbieBF, Nxploited, qalesyaSN. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated arbitrary options update vulnerability in the HyperComments WordPress plugin (CVE-2025-5701), allowing attackers to enable user registration and set the default role to administrator via a crafted POST request.
Description
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Exploits (4)
This PoC demonstrates an unauthenticated arbitrary options update vulnerability in the HyperComments WordPress plugin (CVE-2025-5701), allowing attackers to enable user registration and set the default role to administrator via a crafted POST request.
This is a functional exploit for CVE-2025-5701, targeting an unauthenticated privilege escalation vulnerability in the HyperComments WordPress plugin. It enables user registration and sets the default role to administrator by exploiting a missing capability check.
This exploit targets an unauthenticated privilege escalation vulnerability in WordPress by modifying the default role to 'administrator' and enabling user registration via a POST request to a specific endpoint. It includes multi-threading for mass exploitation and logs vulnerable targets.
The repository contains functional exploit code for CVE-2025-5701, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the vulnerability by uploading a shell file to a vulnerable endpoint.
Nuclei Templates (1)
body="/wp-content/plugins/hypercomments"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H