Add WP Depicter Plugin Unauth SQL Injection (CVE-2025-2011)

[Chocapikk]

Hello Metasploit Team,

This PR implements a new auxiliary scanner module scanner/http/wp_depicter_sqli_cve_2025_2011 for CVE-2025-2011, an UNAUTHENTICATED SQL injection in the Slider & Popup Builder by Depicter plugin (≤ 3.6.1).

The module automates:

1. Database enumeration via a UNION-based payload on admin-ajax.php?s=
2. Table enumeration to infer the WordPress table prefix
3. User credential extraction (user_login:user_pass) from the inferred *_users table
4. Credential creation, loot storage (wordpress.users), and reporting

Verification

• Start msfconsole
• use auxiliary/scanner/http/wp_depicter_sqli_cve_2025_2011
• set RHOSTS <target_ip>
• set RPORT <http_port>
• set TARGETURI /
• set COUNT 1
• Run the module
  • ✔️ Should display:
    • Database name (e.g. exploit_market)
    • Tables list and inferred prefix (e.g. wp_users)
    • User credentials in a formatted table
    • Loot saved under wordpress.users
• Verify credentials are created in the database (if connected)
• Verify no side effects on the plugin or site functionality

[sjanusz-r7]

Should this module be an auxiliary/gather module instead of an auxiliary/scanner?

[Chocapikk]

I don't know. I created several auxiliary modules to exploit WordPress plugins, and they're in scanner. That's why I chose this. What's the difference between the two?