关联漏洞
标题：
WordPress plugin Opal Estate Pro 安全漏洞
(CVE-2025-6934)
描述：WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Opal Estate Pro 1.7.5及之前版本存在安全漏洞，该漏洞源于on_regiser_user函数缺少角色限制，可能导致权限提升。
描述
CVE-2025-6934 - Exploit WordPress Opal Estate Pro
介绍
# CVE-2025-6934 Auto Exploit
---
## ⚡ Overview
**CVE-2025-6934** is a proof-of-concept (PoC) exploit targeting **WordPress Plugin: Opal Estate Pro ≤ 1.7.5**.
This exploit demonstrates **unauthenticated administrator account creation**.
> **Disclaimer:** This PoC is for educational purposes only. Do **not** use on systems without permission.
---
## 🛠 Features
- Detect plugin version automatically.
- Retrieve required nonce for registration.
- Create a new administrator account without authentication.
- Colorful console output with status, success, failure, and info messages.
- Works on Python 3.x with minimal dependencies.
---
## ⚙️ Installation
1. Clone the repository:
```bash
git clone https://github.com/Rosemary1337/CVE-2025-6934.git
cd CVE-2025-6934
````
2. Install dependencies:
```bash
pip install -r requirements.txt
```
> Requirements: `requests`, `beautifulsoup4`, `colorama`
---
## 🚀 Usage
```bash
python3 main.py -u <TARGET_URL> -mail <EMAIL> -password <PASSWORD> -user <USERNAME>
```
### Example:
```bash
python3 main.py -u http://site.com/ -mail admin@horsefucker.org -password 3xplo1tI5Fun -user r1337
```
### Arguments
| Flag | Description | Required | Default |
| -------------------------- | ---------------------- | -------- | --------------- |
| `-u, --url` | Target site URL | Yes | - |
| `-mail, --newmail` | Email for new admin | Yes | - |
| `-password, --newpassword` | Password for new admin | Yes | - |
| `-user, --username` | Username for new admin | No | `administrator` |
---
## 🎨 Output
The console shows:
* Status messages `[•]`
* Success `[✔]`
* Fail `[✖]`
* Info `[i]`
Example:
```
[•] Starting Exploit...
[✔] Nonce Found: xyz123
[✔] Exploit Successful!
Username : r1337
Email : admin@horsefucker.org
Password : 3xplo1tI5Fun
Role : administrator
```
---
## 🔐 Security & Disclaimer
* For **educational & testing purposes only**.
* Do **not** attack websites without explicit permission.
* Use in a controlled lab or authorized penetration test only
---
## 🔗 Connect with Me
I'm an active developer who enjoys building tools and sharing knowledge. You can reach me through:
<p align="left"> <a href="https://github.com/Rosemary1337" target="_blank"> <img src="https://img.shields.io/badge/GitHub-181717?style=for-the-badge&logo=github&logoColor=white"/> </a> <a href="https://t.me/stupidp3rson" target="_blank"> <img src="https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white"/> </a> <a href="https://www.tiktok.com/@justan0therloser" target="_blank"> <img src="https://img.shields.io/badge/TikTok-000000?style=for-the-badge&logo=tiktok&logoColor=white"/> </a> <a href="mailto:rayhanmahardika576@gmail.com" target="_blank"> <img src="https://img.shields.io/badge/Email-8A2BE2?style=for-the-badge&logo=minutemailer&logoColor=white"/> </a> </p>
文件快照
[4.0K] /data/pocs/9147b2c237526b514ec366dc25bcd883ee444720
├── [1.0K] LICENSE
├── [8.7K] main.bin
├── [ 255] main.py
├── [3.2K] README.md
└── [ 33] requirements.txt
0 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。