Sneeit Word Press RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks
Summary: Wordfence reports active exploitation of CVE-2025-6389, a 9.8-severity remote code execution flaw in the Sneeit Framework WordPress plugin affecting all versions through 8.3 and patched in 8.4 on August 5, 2025, with exploitation beginning November 24, 2025, the day of public disclosure. Wordfence says it blocked over 131,000 attack attempts, including 15,381 in a 24-hour window, with requests to /wp-admin/admin-ajax.php creating an admin account named "arudikadis" and uploading a PHP file "tijtewmg.php".
Key Takeaway: The plugin has more than 1,700 active installations, and the flaw needs no authentication - an attacker can call an arbitrary PHP function such as wp_insert_user() to mint an administrator account and take the site. Separately, VulnCheck tied an ICTBroadcast flaw (CVE-2025-2611, CVSS 9.3) to a "frost" binary that carries fourteen exploits for fifteen CVEs and checks for specific response markers before firing, with fewer than 10,000 exposed systems limiting how large that botnet can grow.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-1610CVE-2025-2611CVE-2025-6389
- Related