Loading vulnerability…
CVE-2025-6389 is a critical remote code execution vulnerability in the Sneeit Framework plugin for WordPress affecting all versions up to and including 8.3. The flaw is in the sneeit_articles_pagination_callback() function, which accepts attacker-controlled input and passes it to call_user_func() without adequate validation or restriction. This unsafe dynamic function invocation allows unauthenticated remote attackers to trigger execution of arbitrary code in the context of the web server. Successful exploitation can be used to deploy backdoors, execute malicious PHP, and create unauthorized administrative accounts within the affected WordPress environment.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
6 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone exploit repo containing one Python exploit script, a README, and a license file. The main file, CVE-2025-6389.py, is an operational multithreaded exploit targeting CVE-2025-6389 in the WordPress Sneeit Framework plugin (<= 8.3). The exploit uses requests and a Rich-based terminal UI to process multiple targets concurrently, track progress, and display results. Core exploit logic is in exploit_target_network(). For each supplied target URL, it constructs the endpoint <target>/wp-admin/admin-ajax.php and first sends a probe POST request with action=sneeit_articles_pagination, callback=var_dump, and args=["test"]. It considers the target vulnerable if the response contains markers consistent with PHP var_dump output for the supplied array. If the probe succeeds, it sends a second POST request using callback=wp_insert_user with JSON-like arguments that create a new WordPress administrator account. Usernames are generated as Nxploited_<4 digits>, emails as <username>@gmail.com, and the password is hardcoded to xplpass. The script is clearly an exploit rather than a detector: it performs an actual post-exploitation action by attempting account creation. It is not framework-based. Maturity is OPERATIONAL because it includes a working payload, but customization is limited and the password is hardcoded. The repository structure is simple: the README explains the vulnerability, attack chain, and usage; the Python script implements scanning/exploitation, local result logging, and debug artifact collection. Fingerprintable artifacts include the WordPress AJAX endpoint /wp-admin/admin-ajax.php, the vulnerable action sneeit_articles_pagination, the callbacks var_dump and wp_insert_user, and local output files success_results.txt and debug_responses/*.resp.txt.
Repository contains a single Python exploit script (CVE-2025-6389.py) and a README. The exploit targets CVE-2025-6389: an unauthenticated RCE in the Sneeit Framework WordPress plugin (<= 8.3). It sends an HTTP POST to the WordPress AJAX endpoint /wp-admin/admin-ajax.php with action=sneeit_articles_pagination and a crafted callback parameter set to assert, passing attacker-controlled PHP code in callback[args][]. The script first performs a vulnerability check by attempting to execute phpinfo();die(); and considers the target vulnerable if it sees phpinfo markers or receives a 500 error. If vulnerable, it can execute a single OS command or provide an interactive loop that repeatedly injects PHP system('<cmd>'); and prints the response (truncated to 1000 chars). The README documents installation (requests, colorama), usage examples, and post-exploitation ideas (downloading webshells/reverse shells), but those external URLs are not contacted by the exploit itself unless the operator runs such commands through the RCE.
This repository contains a working exploit for CVE-2025-6389, a critical unauthenticated remote code execution (RCE) vulnerability in the Sneeit Framework WordPress plugin (versions 8.3 and below). The exploit is implemented in a single Python script (CVE-2025-6389.py) and is accompanied by a detailed README.md explaining the vulnerability, usage, and impact. The exploit works by sending a specially crafted POST request to the vulnerable WordPress site's /wp-admin/admin-ajax.php endpoint. It abuses the 'sneeit_articles_pagination' action and the plugin's use of PHP's call_user_func() with unvalidated user input, allowing arbitrary PHP code execution via the assert() function. The script first checks for vulnerability by executing phpinfo(), then provides either a single-command execution or an interactive shell for ongoing command execution as the web server user. No authentication or special headers are required, making exploitation trivial for any publicly accessible, unpatched target. The README provides clear instructions, technical details, and mitigation advice. The exploit is operational, providing real RCE and an interactive shell, but is not part of a larger framework. The only fingerprintable endpoint is the standard WordPress AJAX handler (/wp-admin/admin-ajax.php).
This repository provides a functional proof-of-concept (PoC) and automated scanner for exploiting CVE-2025-6389, a critical unauthenticated remote code execution (RCE) vulnerability in the Sneeit Framework (<= 8.3) for WordPress. The main script, SneeitScanner.py, is a Python tool that can: - Test a single target or a list of targets (from targets.txt) for the vulnerability by sending a POST request to the /wp-admin/admin-ajax.php endpoint with a specially crafted payload exploiting the 'sneeit_articles_pagination' AJAX action. - Confirm RCE by executing phpinfo() and parsing the response. - Allow the attacker to execute arbitrary system commands on vulnerable targets, either interactively (shell mode) or as a one-off command, and display the output. - Provide clean output by parsing the response and removing HTML/WordPress boilerplate. The repository consists of three files: a README.md with detailed usage and background, SneeitScanner.py (the exploit and scanner), and targets.txt (a sample list of target URLs). The exploit does not require authentication and targets a specific AJAX handler in the Sneeit Framework, making it a high-impact vulnerability. The code is a PoC but is fully functional for exploitation and scanning.
This repository contains a working exploit for CVE-2025-6389, a critical unauthenticated remote code execution (RCE) vulnerability in the Sneeit Framework WordPress plugin (versions 8.3 and below). The exploit is implemented in a single Python script (CVE-2025-6389.py) and is accompanied by a detailed README.md explaining the vulnerability, usage instructions, and technical background. The exploit works by sending a specially crafted POST request to the vulnerable WordPress site's /wp-admin/admin-ajax.php endpoint, abusing the 'sneeit_articles_pagination' action and the plugin's unsafe use of call_user_func() to execute arbitrary PHP code. The script first checks if the target is vulnerable by attempting to execute phpinfo(), then provides either an interactive shell or single-command execution capability. The README demonstrates practical usage, including uploading webshells and obtaining reverse shells, and provides clear indicators of successful exploitation. No authentication, cookies, or special headers are required, making this a highly dangerous exploit. The repository is well-structured, with the main exploit logic in the Python file and comprehensive documentation in the README. The only fingerprintable endpoint is the standard WordPress AJAX handler (/wp-admin/admin-ajax.php), which is targeted by the exploit's POST requests.
This repository contains a working exploit for CVE-2025-6389, a critical unauthenticated remote code execution (RCE) vulnerability in the Sneeit Framework WordPress plugin (versions 8.3 and below). The exploit is implemented in a single Python script (CVE-2025-6389.py) and is accompanied by a detailed README.md explaining the vulnerability, usage instructions, and technical background. The exploit works by sending a specially crafted POST request to the vulnerable WordPress site's /wp-admin/admin-ajax.php endpoint, abusing the 'sneeit_articles_pagination' action and the plugin's unsafe use of call_user_func() to execute arbitrary PHP code. The script first checks if the target is vulnerable by attempting to execute phpinfo(), then provides either an interactive shell or single-command execution capability. The README demonstrates practical usage, including uploading webshells and obtaining reverse shells, and provides clear indicators of successful exploitation. No authentication, cookies, or special headers are required, making this a highly dangerous exploit. The repository is well-structured, with the main exploit logic in the Python file and comprehensive documentation in the README. The only fingerprintable endpoint is the standard WordPress AJAX handler (/wp-admin/admin-ajax.php), which is targeted by the exploit's POST requests.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vulnerability in Sneeit Framework listed by the alert as being exploited in a large-scale CMS exploitation campaign.
A publicly known and patched vulnerability affecting Sneeit Framework that is being exploited in a large-scale CMS campaign to deploy webshells.
A vulnerability affecting Sneeit Framework, mentioned as part of a broader ACSC list of CMS/plugin vulnerabilities targeted in a global exploitation campaign.
A vulnerability in Sneeit Framework listed by ACSC as exploited in a global CMS webshell deployment campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.