CVE-2025-9209
CRITICAL NUCLEIRestroPress 3.0.0-3.1.9.2 - Unauthenticated Authentication Bypass via REST API
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-9209. PoCs published by Boshe99, Nxploited. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2025-9209, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the exploit by uploading a malicious file via an unauthenticated endpoint.
Description
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Exploits (2)
The repository contains functional exploit code for CVE-2025-9209, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the exploit by uploading a malicious file via an unauthenticated endpoint.
The repository contains a functional Python exploit for CVE-2025-9209, targeting a WordPress vulnerability. The script automates the extraction of sensitive user metadata (e.g., API keys, tokens) and verifies credentials via REST API endpoints.
Nuclei Templates (1)
http.html:"/wp-content/plugins/restropress/"
body="/wp-content/plugins/restropress/"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H