Black Phantoms BD [Backup]

After updating the administrator account credentials with this script, you can utilize the "Forgot Password" feature on the WordPress login page. By entering the newly set email, you can reset and regain full access to the administrator account via the official dashboard.

This exploit automates the entire attack chain for CVE-2025-7955. It is designed to: Bypass authentication: The script logs into WordPress as any user (usually admin) without needing a password, exploiting the vulnerable 2FA endpoint. Auto-discover usernames: If the username is not provided, the script will attempt to enumerate it via the WordPress REST API (/wp-json/wp/v2/users/ID). Extract required tokens: Automatically fetches the CSRF protection nonce needed for plugin uploads. Upload a malicious plugin (webshell): Once authenticated, the script uploads a ZIP plugin containing a PHP webshell. Command execution via webshell: After successful upload, the script demonstrates code execution by running whoami through the shell and prints the output. Stealth & evasion features: Uses random delays, a rotating User-Agent list, and basic WAF/captcha detection to bypass simple protections.

usage: CVE-2025-32206.py [-h] -u URL -un USERNAME -p PASSWORD

CVE-2026-63030 + CVE-2026-60137