Unauthenticated Privilege Escalation in Essential Addons for Elementor

This repository contains a Python exploit for CVE-2023-32243, targeting the 'Essential Addons for Elementor' WordPress plugin (versions 5.4.0 to 5.7.1). The exploit leverages a vulnerability where the password reset key is not validated, allowing unauthenticated attackers to reset the password of any user (including admin) if the username or email is known or can be enumerated. The main script, 'exploit.py', automates the process: it checks the plugin version, attempts to enumerate usernames using multiple methods (RSS feed, REST API, Yoast sitemap), extracts a required nonce from the site's main page, and sends a crafted POST request to the '/wp-admin/admin-ajax.php' endpoint to reset the password. Upon success, the attacker is provided with credentials to log in as the compromised user. The repository also includes a 'requirements.txt' for dependencies and a README with usage instructions. The exploit is operational and provides a working attack chain for privilege escalation on vulnerable WordPress sites.

This repository contains a Python proof-of-concept exploit for CVE-2023-32243, targeting the Essential Addons for Elementor WordPress plugin. The exploit allows an attacker to reset the password of any user account (account takeover) without authorization on vulnerable plugin versions (between 5.3.9 and 5.7.2). The repository consists of a README.md describing the vulnerability and usage, and exploit.py, which implements the exploit logic. The script first checks the plugin version by fetching the readme.txt file, then obtains a nonce via a POST request to /wp-admin/admin-ajax.php, and finally triggers a password reset for a specified username. The exploit requires the attacker to provide the target URL, username, and new password. The code is operational and demonstrates the full attack chain, but does not include user enumeration functionality (the function is stubbed). The main attack vector is network-based, exploiting exposed WordPress endpoints.

This repository contains a Python script (Mass-CVE-2023-32243.py) that automates exploitation of CVE-2023-32243, a vulnerability in the 'Essential Addons for Elementor' WordPress plugin (versions 5.4.0 to 5.7.1). The script is designed for mass exploitation: it takes a list of target WordPress domains and a password, checks if each target is running a vulnerable plugin version, enumerates usernames via the WordPress REST API, extracts a required nonce from the site's HTML, and sends a crafted POST request to the /wp-admin/admin-ajax.php endpoint to reset the password for a valid user. If successful, it outputs credentials for admin login. The script uses multithreading to process up to 50 domains in parallel. The only code file is Mass-CVE-2023-32243.py; the README provides basic usage instructions. The exploit is operational, as it automates the full attack chain and provides working credentials if successful. Key fingerprintable endpoints include the REST API user enumeration, the admin-ajax.php endpoint, and plugin-specific resource paths used for version checking.

This repository contains a Python exploit script (CVE-2023-32243.py) targeting WordPress sites vulnerable to CVE-2023-32243. The exploit automates the process of enumerating valid WordPress usernames via the REST API (/wp-json/wp/v2/users) or the author sitemap (/author-sitemap.xml). For each discovered user, it attempts to reset the user's password by exploiting the 'login_or_register_user' action exposed via /wp-admin/admin-ajax.php, setting the password to a known value ('Shin_Code403'). If successful, the script logs the credentials for later use. The script is multithreaded and processes a list of target URLs provided by the user. The README provides basic usage instructions. The exploit is operational and can be used to gain unauthorized access to affected WordPress sites.