Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-68860. PoCs published by Nxploited, DedsecTeam-BlackHat.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-68860, which targets a broken authentication vulnerability in WordPress Mobile Builder Plugin <= 1.4.2. The exploit generates a JWT token to authenticate as an admin (user_id=1) and creates a new administrator account.
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
Exploits (2)
This repository contains a functional Python exploit for CVE-2025-68860, which targets a broken authentication vulnerability in WordPress Mobile Builder Plugin <= 1.4.2. The exploit generates a JWT token to authenticate as an admin (user_id=1) and creates a new administrator account.
The repository contains an obfuscated Python script using Pyarmor, which is highly unusual for legitimate PoC releases. The lack of readable code or technical details in the README suggests this may be a lure to download external content or execute malicious payloads.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H