CVE-2025-6934 PoC — Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'

Source

https://github.com/yukinime/CVE-2025-6934

Associated Vulnerability

Title: Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user' (CVE-2025-6934)
Description:The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Readme

# CVE-2025-6934 – Eksploitasi WordPress Opal Estate Pro
<p align="center">
  <img src="https://s.w.org/about/images/logos/wordpress-logo-notext-rgb.png" alt="WordPress Logo" width="200" height="200">
</p>

📖 Deskripsi  
Repositori ini berisi **Proof of Concept (PoC) exploit** untuk **CVE-2025-6934**,  
sebuah kerentanan kritis pada **Plugin WordPress: Opal Estate Pro <= 1.7.5**, yang memungkinkan **pembuatan akun administrator tanpa autentikasi**.

⚠️ **Disclaimer**: Alat ini hanya disediakan untuk **tujuan edukasi dan penelitian keamanan**.  
Penulis **tidak bertanggung jawab** atas penyalahgunaan atau kerusakan yang ditimbulkan.

---

## 🚀 Fitur
- Deteksi otomatis versi plugin dari `readme.txt`
- Ekstraksi nonce untuk registrasi
- Mengeksploitasi endpoint AJAX yang rentan
- Membuat akun **administrator** baru

---

## 🔧 Instalasi
Clone repo dan instal dependensi:

```bash
git clone https://github.com/yukinime/CVE-2025-6934.git
cd CVE-2025-6934

pip3 install -r requirements.txt
```

**requirements.txt**

```
requests
beautifulsoup4
colorama
```

---

## ▶️ Penggunaan

Jalankan skrip dengan target Anda:

```bash
python3 CVE-2025-6934.py -u http://target.com/ -mail newadmin@mail.com -password MySecurePass123 -user newadmin
```

✅ Contoh Output:

```
[✔] Eksploitasi Berhasil!
    Username : newadmin
    Email    : newadmin@mail.com
    Password : MySecurePass123
    Role     : administrator
```

---

## 📸 Screenshot

![Screenshot Eksploitasi](screenshot.png)

---

## 🛡️ Mitigasi

* Perbarui ke **versi terbaru** plugin
* Atau nonaktifkan plugin yang rentan segera
* Pantau log WordPress untuk pembuatan akun tidak sah

---

## 👤 Penulis

**Cyberlone Indonesia** (Cyberlone)

---

## 📜 Lisensi

Proyek ini dilisensikan di bawah **MIT License** – lihat [LICENSE](LICENSE) untuk detailnya.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →